Which type of IOC can you define in Cortex XDR?

The correct answer is B. Destination IP Address. In Cortex XDR, supported Indicators of Compromise (IOCs) include Destination IP Addresses, domains, URLs, and file hashes (MD5, SHA256). Source port (A) and source IP address (D) are not supported IOC types in Cortex XDR's IOC management, as IOCs are threat indicators associated

Submitted by tarun92· Apr 18, 2026Detection and Alert Management

Question

Options

ASource port
BDestination IP Address
CDestination IP Address:Destination
DSource IP Address

How the community answered

(40 responses)

A
8% (3)
B
88% (35)
C
3% (1)
D
3% (1)

Explanation

In Cortex XDR, supported Indicators of Compromise (IOCs) include Destination IP Addresses, domains, URLs, and file hashes (MD5, SHA256). Source port (A) and source IP address (D) are not supported IOC types in Cortex XDR's IOC management, as IOCs are threat indicators associated with malicious destinations or file attributes-not originating source network parameters. 'Destination IP Address:Destination' (C) is a malformed/combined format that is not a valid IOC type.

Topics

#IOCs#Cortex XDR#Detection#Security Policy

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice