XSIAM-ANALYST · Question #2
A Cortex XSIAM analyst is investigating a security incident involving a workstation after having deployed a Cortex XDR agent for 45 days. The incident details include the Cortex XDR Analytics Alert…
The correct answer is C. Initiate the endpoint isolate action to contain the threat. An "Uncommon remote scheduled task creation" suggests possible remote code execution or persistence. Isolating the affected endpoint immediately cuts it off from the network, stopping command-and-control or lateral movement while you investigate and remediate.
Question
A Cortex XSIAM analyst is investigating a security incident involving a workstation after having deployed a Cortex XDR agent for 45 days. The incident details include the Cortex XDR Analytics Alert "Uncommon remote scheduled task creation." Which response will mitigate the threat?
Options
- ARevoke user access and conduct a user audit.
- BAllow list the processes to reduce alert noise.
- CInitiate the endpoint isolate action to contain the threat.
- DPrioritize blocking the source IP address to prevent further login attempts.
How the community answered
(29 responses)- A3% (1)
- B3% (1)
- C79% (23)
- D14% (4)
Explanation
An "Uncommon remote scheduled task creation" suggests possible remote code execution or persistence. Isolating the affected endpoint immediately cuts it off from the network, stopping command-and-control or lateral movement while you investigate and remediate.
Topics
Community Discussion
No community discussion yet for this question.