Palo_Alto_Networks
XDR-ENGINEER · Question #26
Which XQL query can be saved as a behavioral indicator of compromise (BIOC) rule, then converted to a custom prevention rule?
Sign in or unlock XDR-ENGINEER to reveal the answer and full explanation for question #26. The question stem and answer options stay visible for context.
Detection Engineering
Question
Which XQL query can be saved as a behavioral indicator of compromise (BIOC) rule, then converted to a custom prevention rule?
Options
- Adataset = xdr_data| filter event_type = ENUM.DEVICE and action_process_image_name = "**"and
- Bdataset = xdr_data| filter event_type = ENUM.PROCESS and event_type = ENUM.DEVICE and
- Cdataset = xdr_data| filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or
- Ddataset = xdr_data| filter event_type = ENUM.PROCESS and action_process_image_name =
Unlock XDR-ENGINEER to see the answer
You've previewed enough free XDR-ENGINEER questions. Unlock XDR-ENGINEER for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#XQL query#BIOC rules#custom prevention rules#event_type PROCESS