Cortex XDR
Cortex XDR is the endpoint-centric detection and response platform. The exam tests the agent's protection modules, the alert-to-incident path, and the rule types used for detection.
Agent protection modules
- Malware Protection uses signatures and local static analysis.
- Exploit Protection blocks behavioral exploitation techniques.
- Behavioral Threat Analysis runs local BIOCs on the endpoint.
- Local analysis can act without cloud connectivity; cloud analysis with WildFire returns verdicts on unknown files.
- Policies attach to endpoint groups; exceptions and alert exclusions reduce noise but also reduce coverage.
Detection and investigation
- BIOC (Behavioral Indicator of Compromise) rules describe process and behavior sequences.
- IOC rules match atomic indicators: hashes, IPs, domains, filenames.
- Alerts roll up into incidents; causality analysis builds the causality chain showing the root process and its descendants.
- XQL queries endpoint telemetry for hunting and validation.
Worked example
An alert shows powershell.exe spawning from winword.exe, but WildFire has no malware verdict. Reasoning: this is a behavior detection, not a file-signature verdict. Open the causality chain to confirm the Office parent, use XQL to pull the full command line and child processes, and check the BIOC that fired. Closing it as a false positive because 'no verdict' exists is wrong - behavioral rules intentionally fire without a file verdict.
Traps
- Treating local analysis and cloud analysis as interchangeable; local uses on-agent logic.
- Confusing BIOC (behavior) with IOC (atomic indicator).
- Forgetting that an exclusion can suppress the exact rule under test.
- Reading the causality chain as a full alert timeline; it is process ancestry for one alert.