When reaching out to TAC for additional technical support related to a Security Event; what are two critical pieces of information you need to collect from the Agent? (Choose two.)

The correct answer is B. The unique agent id. D. The agent technical support file. When contacting Palo Alto Networks TAC for support related to a security event on a Cortex XDR agent, two critical pieces of information are: (B) the unique agent ID - which allows TAC to identify and correlate the specific agent in question - and (D) the agent technical…

Submitted by wei.xz· Apr 18, 2026Investigation and Response

Question

Options

AThe prevention archive from the alert.
BThe unique agent id.
CThe distribution id of the agent.
DThe agent technical support file.
EA list of all the current exceptions applied to the agent.

How the community answered

(41 responses)

A
2% (1)
B
90% (37)
C
2% (1)
E
5% (2)

Explanation

When contacting Palo Alto Networks TAC for support related to a security event on a Cortex XDR agent, two critical pieces of information are: (B) the unique agent ID - which allows TAC to identify and correlate the specific agent in question - and (D) the agent technical support file - a diagnostic bundle generated by the agent that contains logs, configuration data, and telemetry needed for deep troubleshooting. The prevention archive (A) is not a standard TAC requirement, the distribution ID (C) is less critical for event-level investigations, and a list of exceptions (E) is supplementary context, not a primary requirement.

Topics

#TAC Support#Agent Troubleshooting#Security Event Response#Diagnostic Data

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice