When creating a BIOC rule, which XQL query can be used?

The correct answer is B. dataset = xdr_data. This question appears to have a formatting issue where all four answer choices display identically as 'dataset = xdr_data'. In Cortex XDR, Behavioral Indicators of Compromise (BIOC) rules are authored using XQL (Extended Query Language) and must query the 'xdr_data' dataset, whic

Submitted by krish.m· Apr 18, 2026Detection and Alert Management

Question

Options

Adataset = xdr_data
Bdataset = xdr_data
Cdataset = xdr_data
Ddataset = xdr_data

How the community answered

(63 responses)

A
2% (1)
B
92% (58)
C
2% (1)
D
5% (3)

Explanation

This question appears to have a formatting issue where all four answer choices display identically as 'dataset = xdr_data'. In Cortex XDR, Behavioral Indicators of Compromise (BIOC) rules are authored using XQL (Extended Query Language) and must query the 'xdr_data' dataset, which contains endpoint telemetry events collected by the Cortex XDR agent. The correct XQL foundation for a BIOC rule is 'dataset = xdr_data', which scopes the query to the primary behavioral telemetry data store. Answer B is designated correct, and in practice this query dataset is the standard starting point for all BIOC rule definitions in Cortex XDR.

Topics

#BIOC rules#XQL#Cortex XDR#Detection

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice