PCDRA · Question #58
Under which conditions is Local Analysis evoked to evaluate a file before the file is allowed to run?
The correct answer is B. The endpoint is disconnected or the verdict from WildFire is of a type unknown. Local Analysis is Cortex XDR's on-device machine learning engine used as a fallback when cloud-based WildFire analysis is unavailable or inconclusive. It is invoked under two specific conditions: (1) the endpoint is offline or disconnected from the Cortex XDR infrastructure and…
Question
Under which conditions is Local Analysis evoked to evaluate a file before the file is allowed to run?
Options
- AThe endpoint is disconnected or the verdict from WildFire is of a type malware.
- BThe endpoint is disconnected or the verdict from WildFire is of a type unknown.
- CThe endpoint is disconnected or the verdict from WildFire is of a type grayware.
- DThe endpoint is disconnected or the verdict from WildFire is of a type benign.
How the community answered
(29 responses)- A7% (2)
- B86% (25)
- C3% (1)
- D3% (1)
Explanation
Local Analysis is Cortex XDR's on-device machine learning engine used as a fallback when cloud-based WildFire analysis is unavailable or inconclusive. It is invoked under two specific conditions: (1) the endpoint is offline or disconnected from the Cortex XDR infrastructure and cannot reach WildFire, or (2) WildFire returns an 'unknown' verdict - meaning the file has not been seen before or cannot be conclusively classified. Files already classified as malware, grayware, or benign already have a definitive WildFire verdict and do not need local re-analysis.
Topics
Community Discussion
No community discussion yet for this question.