PSE Cortex flashcards
PSE Cortex · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- XSIAM data ingestion brokers
- On-premises components that pull logs from local sources and forward them to the Cortex XSIAM cloud tenant, enabling collection from networks that cannot expose sources directly to the internet.
- BIOC rule
- Behavioral Indicator of Compromise: an XSIAM detection rule written in a YAML-like syntax that matches sequences of endpoint and network events rather than static signatures.
- Issue grouping
- XSIAM mechanism that merges related alerts into a single incident based on shared attributes, reducing analyst alert volume and consolidating the investigation context.
- XSIAM ASM module
- Agentless attack surface management inside XSIAM that discovers external-facing assets and scores their risk from an outside-in perspective.
- Cortex XSIAM pillars
- Prevention, Detection, and Response: the three functional pillars that combine endpoint agents, analytics engines, and automated playbooks in one SecOps platform.
- Playbook trigger conditions
- Rules in XSIAM that decide which incidents automatically launch a playbook, based on incident type, severity, or field values at creation time.
- XDR causality chain
- A view of the process ancestry leading to a detection, showing the parent processes, initiating user, and root cause of the activity on the endpoint.
- Agent protection modules
- Configurable XDR defenses such as Malware, Exploit, Ransomware, and Behavioral Threat, each settable to Off, Report, or Block within an endpoint policy profile.
- Endpoint isolation
- An XDR response action that blocks all network traffic to and from an endpoint except the management channel, containing a threat while allowing analyst control.
- Alert versus incident
- An alert is a single detection event; an incident is a correlated group of alerts tied to one endpoint and causality chain for unified triage.
- Wildfire verdict
- A cloud verdict on a file hash produced by dynamic and static analysis; a malicious verdict commonly triggers quarantine through the agent policy.
- Agent policy profile
- A set of endpoint settings defining enabled modules, scan schedules, and agent behavior, assigned to endpoints through endpoint groups.
- Offline endpoint buffering
- When an XDR agent cannot reach the cloud, it stores events locally and uploads them once connectivity is restored, preserving detection history.
- XDR endpoint groups
- Logical collections of endpoints used to target policy profiles and response actions; group membership determines which settings an agent receives.
- XSOAR War Room
- The per-incident workspace where analysts chat, run integration commands with the exclamation prefix, and store command results as investigation evidence.
- XSOAR context data
- A per-incident JSON store holding command outputs and incident fields, referenced in playbooks using dot notation such as IP.Address.
- XSOAR conditional task
- A playbook task type that branches the flow based on evaluating the output or context values produced by earlier tasks.
- XSOAR classifier and mapper
- Components that translate incoming raw data into XSOAR incidents: the classifier assigns incident type, and the mapper populates incident fields.
- XSOAR content pack
- A versioned bundle of playbooks, scripts, integrations, and layouts installed from the Marketplace to add capabilities to a tenant.
- CommonServerPython library
- A helper library for XSOAR Python automation scripts providing functions for returning results, building context outputs, and handling command arguments.
- XSOAR integration instance
- A configured connection to an external product, holding credentials and settings, whose commands become available to playbooks and the CLI.
- XSOAR manual task
- A playbook task that pauses execution and waits for an analyst to complete an action or provide input before the flow continues.
- Xpanse outside-in discovery
- Agentless scanning of internet address space that fingerprints exposed services and attributes them to an organization without installing anything on the asset.
- Xpanse ownership rules
- Rules using IP ranges, ASNs, certificates, and domain patterns to associate discovered internet assets with the correct organization.
- Xpanse attack surface rule
- A definition of expected versus unexpected services on owned IP space; unexpected services produce high-signal exposure findings.
- Xpanse risk scoring
- A ranking of findings that weighs exposure, exploitability, and business criticality to prioritize which internet-facing issues to remediate first.
- Xpanse shadow IT discovery
- Detection of unknown or forgotten internet-facing assets, such as unmanaged cloud instances, that the organization did not know it owned.
- Cortex Cloud CSPM
- Cloud security posture management that evaluates resource configurations against benchmarks like CIS and PCI DSS and raises misconfigurations as alerts.
- Cortex Cloud CWPP
- Cloud workload protection that secures VMs, containers, and serverless functions with runtime defense and vulnerability management.
- Cortex Cloud CIEM
- Cloud infrastructure entitlement management that analyzes effective permissions to find excessive or unused privileges and risky identity paths.
- Cloud attack path analysis
- A technique that chains misconfigurations, identities, and network exposure to show how an attacker could reach critical data.
- Cortex Cloud policy
- The core rule unit defining a cloud configuration check, its severity, and remediation guidance; compliance standards map to sets of these policies.