Which XQL query can be saved as a behavioral indicator of compromise (BIOC) rule, then converted to a custom prevention rule?

Question

Options

• Adataset = xdr_data| filter event_type = ENUM.DEVICE and action_process_image_name = "**"and
• Bdataset = xdr_data| filter event_type = ENUM.PROCESS and event_type = ENUM.DEVICE and
• Cdataset = xdr_data| filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or
• Ddataset = xdr_data| filter event_type = ENUM.PROCESS and action_process_image_name =

• A
  33% (8)
• B
  8% (2)
• C
  13% (3)
• D
  46% (11)

Explanation

Option D is correct because custom prevention rules in Cortex XDR can only be derived from BIOC rules that filter on ENUM.PROCESS event types - the prevention engine works by intercepting and blocking process execution, so the underlying query must target process activity with a specific action_process_image_name condition to define what gets blocked.

Why the distractors fail:

• Option A uses ENUM.DEVICE, which captures hardware/device interactions - device events have no execution to block, so this type cannot be converted to a prevention rule.
• Option B attempts to filter on both ENUM.PROCESS and ENUM.DEVICE simultaneously on the same event, which is a logical impossibility - a single event cannot satisfy both types, so the query would return nothing and is structurally invalid for a BIOC rule.
• Option C uses event_type = FILE - file-based BIOC rules can detect suspicious file creation, but Cortex XDR does not support converting FILE-based BIOC rules into prevention rules; only PROCESS-based ones qualify for that conversion.

Memory tip: Think "Prevention = Process" - you can only prevent what you can intercept at execution, which means the query must be anchored to ENUM.PROCESS. Any other event type (FILE, DEVICE, NETWORK) describes something that already happened, not something being launched.

No community discussion yet for this question.