Threat Detection with Cortex XSIAM
Threat Detection with Cortex XSIAM
This domain tests how XSIAM turns ingested telemetry into detections and incidents. Focus on data normalization to XDM, analytics and correlation rules, BIOCs, XQL, and MITRE ATT&CK mapping.
Core rules
- Data is normalized into the XSIAM Data Model (XDM). Detections and queries should use XDM fields, not vendor-specific raw fields, so coverage survives source changes.
- Analytics provide AI/ML and behavioral detections; correlation rules group alerts into incidents using conditions and time windows.
- BIOCs describe behavior such as process ancestry and command-line patterns, while IOCs describe static artifacts such as hashes and domains.
- XQL is the query language for investigation, tuning, and scheduled jobs. Use it to validate a detection before enabling it.
- Map detections to MITRE ATT&CK tactics and techniques to find coverage gaps and explain severity. Broker VM extends collection to remote networks, so confirm sources are onboarded and parsed.
Worked example
You need to detect credential dumping on Windows. An analytic or correlation rule looks for a non-standard process accessing LSASS memory, then groups events by host over 10 minutes. In XQL you validate with XDM fields such as xdm.event.type, xdm.process.name, and xdm.target.process.name. If the parent process is a known backup tool, add an exclusion. Reasoning: behavior-based logic catches variants that a static hash misses; the time window reduces duplicate incidents; the exclusion controls false positives without disabling the rule.
Traps
- Writing rules against raw vendor fields, which break after parser changes.
- Treating a BIOC as a hash IOC.
- Setting time windows too wide, producing noisy incidents, or too narrow, missing multi-stage behavior.
- Forgetting data latency: a rule can fire before all relevant events arrive.
- Mapping every alert to the same ATT&CK technique, which hides coverage gaps.