XSIAM-ENGINEER: Palo Alto Networks Certified XSIAM Engineer

By Palo Alto Networks · Question Mode

QuestionQ17

VerifiedMaintenance and Troubleshooting

A vulnerability analyst asks a Cortex XSIAM engineer to identify assets vulnerable to a newly reported zero-day CVE affecting the ai_app application and versions 12.1, 12.2, 12.4, and 12.5.

Which XQL query provides the required result?

Explanation

Application vulnerability scoping requires inventory records for the affected application and the affected installed versions. The host_inventory_applications preset provides the application-inventory source, and filtering application_name for ai_app together with version in ("12.1", "12.2", "12.4", "12.5") returns assets running exactly the vulnerable versions. Cortex XSIAM documents host_inventory_applications as a Host Inventory and Vulnerability Assessment preset.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!