Which Type of IOC can you define in Cortex XDR?

The correct answer is C. full path. Cortex XDR supports a specific set of Indicator of Compromise (IOC) types for threat detection and prevention. Supported IOC types include file hashes (MD5, SHA256), IP addresses, domain names, URLs, and full file paths. 'Full path' (option C) is a valid IOC type that allows…

Submitted by helene.fr· Apr 18, 2026Detection and Alert Management

Question

Options

Adestination port
Be-mail address
Cfull path
DApp-ID

How the community answered

(43 responses)

A
5% (2)
B
2% (1)
C
91% (39)
D
2% (1)

Explanation

Cortex XDR supports a specific set of Indicator of Compromise (IOC) types for threat detection and prevention. Supported IOC types include file hashes (MD5, SHA256), IP addresses, domain names, URLs, and full file paths. 'Full path' (option C) is a valid IOC type that allows you to flag a specific file at a known location as malicious. Destination port and App-ID are Palo Alto Networks firewall/NGFW constructs - not IOC types in Cortex XDR. Email address is not a supported IOC type in Cortex XDR's IOC management interface.

Topics

#IOC#Cortex XDR#Threat Intelligence#Detection

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice