An engineer wants to automate the handling of alerts in Cortex XDR and defines several automation rules with different actions to be triggered based on specific alert conditions. Some alerts do not…

Question

Options

• AThey are executed in sequential order, so alerts may not trigger the correct actions if the rules are
• BThey only apply to new alerts grouped into incidents by the system and only alerts that
• CThey can only be triggered by alerts with high severity; alerts with low or informational severity will
• DThey can be applied to any alert, but they only work if the alert is manually grouped into an

• A
  58% (22)
• B
  13% (5)
• C
  5% (2)
• D
  24% (9)

Explanation

Automation rules in Cortex XDR are evaluated in sequential order, meaning an alert stops being evaluated the moment it matches a rule. If a broader or lower-priority rule appears earlier in the sequence, it will "catch" alerts before they ever reach a more specific intended rule - causing the expected action to never trigger. This ordering dependency is the most common reason rules fail to fire as designed.

Why the distractors are wrong:

• B is misleading - automation rules don't have a restriction tied exclusively to how alerts are grouped into incidents; grouping method alone doesn't block rule evaluation.
• C is false - automation rules can be configured for any alert severity, including low and informational; severity alone doesn't gate rule execution.
• D is false - automation rules apply to alerts in automatically created incidents; requiring manual grouping would defeat the purpose of automation.

Memory tip: Think of automation rules like a bouncer line - each alert gets checked against rules in order, and the first match claims it. A greedy early rule blocks all the rules behind it, so order matters as much as the rule logic itself.

No community discussion yet for this question.