What should be configured in Cortex XDR to integrate asset data from Microsoft Azure for better visibility and incident investigation?

Question

Options

• AAzure Network Watcher
• BCloud Identity Engine
• CCloud Inventory
• DMicrosoft 365

• A
  5% (2)
• B
  5% (2)
• C
  88% (36)
• D
  2% (1)

Explanation

Cloud Inventory is the correct Cortex XDR configuration for integrating asset data from Microsoft Azure. It pulls in cloud asset information - virtual machines, storage, network resources, identities - giving security teams full visibility into their cloud environment for incident investigation and attack surface analysis.

Why the distractors are wrong:

• A. Azure Network Watcher is an Azure-native monitoring tool for diagnosing network issues; it's not a Cortex XDR configuration component.
• B. Cloud Identity Engine focuses on identity-based policy and user context (e.g., mapping users across directories), not asset inventory data from cloud platforms.
• D. Microsoft 365 is a productivity suite integration relevant to email/collaboration telemetry, not cloud infrastructure asset visibility.

Memory tip: Think "Inventory = Assets." If you need to see what's in your cloud (virtual machines, storage, configs), you need an inventory - Cloud Inventory. Cloud Identity Engine = who, Cloud Inventory = what.

No community discussion yet for this question.