An XDR engineer is creating a correlation rule to monitor login activity on specific systems. When the activity is identified, an alert is created. The alerts are being generated properly but are…

Question

Options

• ASelect "Initial Access" in the MITRE ATT&CK mapping to include the username
• BUpdate the query in the correlation rule to include the username field
• CAdd a mapping for the username field in the alert fields mapping
• DAdd a drill-down query to the alert which pulls the username field

• A
  6% (1)
• B
  6% (1)
• C
  78% (14)
• D
  11% (2)

Explanation

Option C is correct because in XDR platforms, correlation rules generate alerts based on matched events, but the fields displayed in those alerts are controlled separately through alert field mappings - if username isn't mapped as an alert field, it simply won't appear in the alert output, even if the underlying event data contains it. Adding the username field to the alert fields mapping tells the platform to surface that value in the alert UI.

Why the distractors are wrong:

• A is wrong because MITRE ATT&CK mappings categorize the tactic/technique of an attack for classification purposes - they have no effect on which data fields are displayed in an alert.
• B is wrong because the alerts are already generating correctly (the query is working); the problem is display/surfacing, not data retrieval - tweaking the query wouldn't fix a field visibility issue.
• D is wrong because drill-down queries are used for post-alert investigation pivots, not for populating core alert fields that analysts see at first glance.

Memory tip: Think of it as a "what you map is what you see" rule - correlation rules find the event, but alert field mappings define what gets shown. If a field is missing from an alert, look at the mapping before touching the query.

No community discussion yet for this question.