nerdexam
Palo_Alto_Networks

PCDRA · Question #45

What should you do to automatically convert leads into alerts after investigating a lead?

The correct answer is D. Create BIOC rules based on the set of the collected attribute-value pairs over the affected entities. To automatically convert investigated leads into alerts for future detection, you should create Behavioral Indicator of Compromise (BIOC) rules.

Submitted by paula_co· Apr 18, 2026Detection and Alert Management

Question

What should you do to automatically convert leads into alerts after investigating a lead?

Options

  • ALead threats can't be prevented in the future because they already exist in the environment.
  • BBuild a search query using Query Builder or XQL using a list of IOCs.
  • CCreate IOC rules based on the set of the collected attribute-value pairs over the affected entities
  • DCreate BIOC rules based on the set of the collected attribute-value pairs over the affected entities

How the community answered

(15 responses)
  • A
    7% (1)
  • B
    13% (2)
  • D
    80% (12)

Why each option

To automatically convert investigated leads into alerts for future detection, you should create Behavioral Indicator of Compromise (BIOC) rules.

ALead threats can't be prevented in the future because they already exist in the environment.

This statement is incorrect as the goal is to prevent future occurrences, which is achievable through detection rules.

BBuild a search query using Query Builder or XQL using a list of IOCs.

While useful for searching, a search query itself does not automatically convert future leads into alerts; it's a retroactive search tool.

CCreate IOC rules based on the set of the collected attribute-value pairs over the affected entities

IOC rules are based on static indicators like file hashes or IP addresses, which are less effective for detecting evolving or polymorphic threats compared to behavioral rules.

DCreate BIOC rules based on the set of the collected attribute-value pairs over the affected entitiesCorrect

BIOC rules leverage the collected attribute-value pairs (behaviors) of an observed threat to define patterns that, when matched, automatically generate alerts, effectively turning investigated leads into proactive detections. These rules focus on specific sequences of actions or events, making them effective for detecting complex, multi-stage attacks.

Concept tested: Creating BIOC rules for automated threat detection

Source: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/BIOC-Rules

Topics

#BIOC rules#Lead management#Automated detection#Alert creation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCDRA Practice