XDR-ENGINEER · Question #16
An XDR engineer is configuring an automation playbook to respond to high-severity malware alerts by automatically isolating the affected endpoint and notifying the security team via email. The…
The correct answer is A. Alert severity is High C. Alert category is Malware. Selecting Alert severity is High (A) and Alert category is Malware (C) directly maps to the two stated requirements: the alert must be high-severity, and it must involve malware. Critically, in Cortex XDR, the Malware category is exclusively assigned by the analytics engine…
Question
An XDR engineer is configuring an automation playbook to respond to high-severity malware alerts by automatically isolating the affected endpoint and notifying the security team via email. The playbook should only trigger for alerts generated by the Cortex XDR analytics engine, not custom BIOCs. Which two conditions should the engineer include in the playbook trigger to meet these requirements? (Choose two.)
Options
- AAlert severity is High
- BAlert source is Cortex XDR Analytics
- CAlert category is Malware
- DAlert status is New
How the community answered
(55 responses)- A55% (30)
- B16% (9)
- D29% (16)
Explanation
Selecting Alert severity is High (A) and Alert category is Malware (C) directly maps to the two stated requirements: the alert must be high-severity, and it must involve malware. Critically, in Cortex XDR, the Malware category is exclusively assigned by the analytics engine - custom BIOCs generate alerts under a "BIOC" category - so filtering on Category = Malware inherently excludes custom BIOCs without needing an explicit source filter.
Option B is a trap: while "Alert source is Cortex XDR Analytics" sounds like a direct match for excluding custom BIOCs, it is not a standard available trigger condition in the Cortex XDR playbook trigger interface; the category field is the actual mechanism used to distinguish alert origins.
Option D (Alert status is New) is a generic default condition that doesn't address severity, type, or source - it would cause the playbook to trigger on any new alert regardless of whether it's malware or high-severity.
Memory tip: Think "S+C = the What" - Severity tells you how bad, Category tells you what kind. Together they fully define the alert the scenario describes, and Category does double duty by implicitly filtering out custom BIOCs.
Topics
Community Discussion
No community discussion yet for this question.