Palo Alto SecOps Architect flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Incident scoring

A dynamic 0-100 relative severity value on a Cortex platform incident, computed from alert severity, asset criticality, identity risk, and threat intelligence, and recalculated as new evidence arrives.

Alert grouping

A platform mechanism that clusters related alerts sharing entities such as host, user, IP, or hash into one incident; it runs before scoring, so tuning grouping changes scoring inputs.

UEBA risk decay

Behavioral analytics baselines per-entity activity and accumulates risk on users and hosts; risk decays over time, so sustained deviation, not a single event, drives high-risk designation.

Causality linking

A platform feature that chains alerts sharing an initiating process, session, or flow into one incident; the earliest causal anchor is the root cause node, and closing it can close children.

Playbook trigger types

Automation playbooks in the AI-driven platform start on incident creation, alert creation, or manual invocation, and each executed task logs input and output in the war room for audit.

AI conclusion validation

AI-assisted investigation output is a hypothesis; analysts must confirm generated conclusions against raw process, network, and identity telemetry before approving containment or remediation actions.

Cloud vs on-prem AI

Cloud analytics features require telemetry forwarded to the region-specific tenant; on-premises deployments expose only locally bundled model features, so available AI capability differs by deployment.

XDM schema

XSIAM's normalized data model that maps endpoint, network, identity, and cloud logs into common fields, letting detection rules and queries work identically across all sources.

Broker role

XSIAM brokers collect and buffer incoming telemetry before forwarding to the analytics engine; broker CPU, disk, and connectivity are the first checks when queries return no data.

Correlation rule anatomy

An XSIAM detection consisting of an XQL query, a schedule or streaming trigger, and an alert template that maps query fields into the incident schema for incident creation.

XQL evaluation order

XQL pipes evaluate left to right; place filters and field selection before stats or join operations to reduce scanned data and query cost.

Grouping vs alert table

Alerts suppressed by XSIAM grouping still appear in the alert table but do not create separate incidents; severity mapping and grouping configuration control incident creation.

XSIAM content packs

Integrations and playbooks in XSIAM install as versioned content packs and share the XSOAR playbook runtime; each integration needs a configured, tested instance before use.

Tiered retention

XSIAM stores recent data in hot searchable tiers and older data in cold or archive tiers; cold queries run slower and may be limited by license level.

XSOAR server and engines

The XSOAR server hosts the API, playbook engine, and database, while engines execute playbook tasks including Docker-based scripts; integrations are Python packages run by engines.

Incident close reasons

Closing an XSOAR incident requires a close reason; reason codes aggregate into reporting that reveals detection quality, such as true positive versus false positive rates.

Playbook task types

XSOAR playbook tasks are standard (integration command or script), conditional (router), manual (analyst decision), or section header; each supports timeouts and per-outcome next-task mapping.

Context path errors

XSOAR context is a JSON store keyed by path; incorrect references such as incident.customFields versus incident.fieldname cause empty task inputs and failed playbook branches.

Classifier and mapper

XSOAR classifiers assign incoming incidents to an incident type, and mappers fill fields; misconfiguration routes incidents to the wrong playbook, so test with sample payloads.

Indicator database

XSOAR indicators are stored separately from incidents; reputation commands enrich them, and indicator expiration and scoring are configured per indicator type in settings.

Content pack overwrite risk

Installing a newer content pack can overwrite customized playbooks, scripts, and layouts; detach or fork customized content before upgrading to preserve local changes.

Cortex XDR agent telemetry

The endpoint agent records process execution, file operations, network connections, registry changes, and injected code, and can be supplemented by network and cloud data sources.

Causality chain

XDR's investigation view links processes, files, and network activity into a tree anchored at a root cause, exposing the full attack sequence from a single alert.

Prevention vs security policy

Prevention settings block activity on the endpoint, such as malware, exploits, and restriction profiles; security settings govern detection behavior, exclusions, and agent configuration.

Agent settings profile

An XDR console profile that controls agent behavior and version targeting; it determines which agent version endpoints upgrade to and when upgrades occur.

Severity vs star rating

Severity is a detection's intrinsic risk assigned by the platform; the star rating is the analyst's recorded judgment, and both feed reporting and exclusion tuning decisions.

Narrow exclusions

XDR exceptions should be scoped by hash, signer, path, or command line and reviewed periodically, because broad exclusions are a leading cause of missed detections.

Endpoint isolation

An XDR response action executed through the agent that blocks network communication except the management channel; the action and its status are logged in the action center.

Xpanse attribution

Xpanse attributes internet-facing services to an organization using registration, certificate, and network evidence rather than agents; confidence scores indicate how certain the attribution is.

Asset states

Xpanse assets include domains, IPs, certificates, and cloud resources; each carries a state such as approved, unapproved, or flagged that determines inventory visibility and workflow.

Exposure categories

Xpanse groups findings into risk categories such as exposed remote access, vulnerable services, and misconfigured cloud storage, each with severity and remediation guidance.

Cloud connector reconciliation

Xpanse cloud connectors for AWS, Azure, and GCP compare scanned assets against cloud inventory; assets found by scanning but absent from inventory indicate shadow IT or orphaned resources.

Remediation re-scan

The Xpanse workflow is review finding, verify attribution and ownership, assign owner, fix at the source, then re-scan; closing without re-scan risks a false closure.