What is the primary purpose of using lookup tables in Cortex XDR?

The correct answer is B. To enrich query results with external or static data. Lookup tables enrich XQL query results by correlating telemetry data with static or external datasets such as IP lists, host owners, or asset mappings.

XQL Query and Threat Hunting

Question

Options

ATo store email configurations for alerting
BTo enrich query results with external or static data
CTo create scheduled agent updates
DTo manage firewall policy settings

How the community answered

(33 responses)

A
15% (5)
B
76% (25)
C
3% (1)
D
6% (2)

Explanation

Lookup tables enrich XQL query results by correlating telemetry data with static or external datasets such as IP lists, host owners, or asset mappings.

Topics

#lookup tables#data enrichment#XQL#query results

Community Discussion

No community discussion yet for this question.

Full XDR-ANALYST Practice