Which action is being taken with the query below? dataset = xdr_data | fields agent_hostname, _time, _product | comp latest as latest_time by agent_hostname, _product | join type=inner (dataset =…

Question

Options

• AMonitoring the latest activity of endpoints
• BIdentifying endpoints that have disconnected from the network
• CMonitoring the latest activity of connected firewall endpoints
• DChecking for endpoints with outdated agent versions

• A
  42% (11)
• B
  15% (4)
• C
  35% (9)
• D
  8% (2)

Explanation

Option A is correct because the query computes the latest timestamp (comp latest as latest_time) for each agent across XDR data, joins it with endpoint metadata, and returns the most recent activity per connected endpoint - that's the definition of monitoring latest activity.

Why the distractors are wrong:

• B is wrong because the query explicitly filters endpoint_status = ENUM.CONNECTED, keeping only connected endpoints, not disconnected ones.
• C is wrong because there is no filter on endpoint type or product that restricts results to firewalls - _product is just returned as an output field, not used as a filter.
• D is wrong because the query contains no version field, no version comparison, and no logic to identify outdated agents.

Memory tip: Focus on the comp latest aggregation (what it does) and the filter ENUM.CONNECTED condition (what it includes). When you see comp latest + CONNECTED filter + no type/version restriction, think "monitoring recent activity of active endpoints" - the query is a health dashboard snapshot, not a hunt for problems.

No community discussion yet for this question.