How does Cisco XDR perform threat prioritization by using its visibility across multiple platforms?

Question

Options

• ABy assigning priority based on the detection platform
• BBy correlating detection risk and asset value at risk
• CBy prioritizing threats based on their frequency across platforms
• DBy using a fixed priority system for all platforms

• A
  16% (5)
• B
  72% (23)
• C
  3% (1)
• D
  9% (3)

Explanation

Cisco XDR prioritizes threats by correlating two key factors: the detection risk score (how dangerous or confident the threat signal is) and the asset value at risk (how critical the affected system is to the organization). This cross-platform correlation produces a meaningful, context-aware priority rather than arbitrary rankings, which is the core differentiator of XDR over siloed tools.

Why the distractors are wrong:

• A is wrong because XDR explicitly avoids platform-based bias - a low-confidence alert from a high-value platform shouldn't automatically outrank a high-confidence alert from a less prominent one.
• C is wrong because frequency alone is misleading; a rare, targeted attack on a critical asset is far more dangerous than a common, low-impact event appearing across many platforms.
• D is wrong because a fixed priority system defeats the purpose of XDR's dynamic, intelligence-driven correlation - static rules can't adapt to context.

Memory tip: Think of it as a Risk × Value formula. XDR asks two questions simultaneously: "How bad is this threat?" (risk) and "How important is what's being targeted?" (asset value). Only when both are considered together do you get true, actionable prioritization.

No community discussion yet for this question.