XSIAM-ANALYST · Question #33
An analyst conducting a threat hunt needs to collect multiple files from various endpoints. The analyst begins the file retrieval process by using the Action Center, but upon review of the retrieved…
The correct answer is A. The file retrieval policy applied to the endpoints may restrict access to certain system or kernel. File retrieval in XSIAM/XDR honors the endpoint's retrieval policy. If that policy excludes sensitive areas (like system or kernel files), those items will not be collected, resulting in an incomplete set.
Question
An analyst conducting a threat hunt needs to collect multiple files from various endpoints. The analyst begins the file retrieval process by using the Action Center, but upon review of the retrieved files, notices that the list is incomplete and missing files, including kernel files. What could be the reason for this issue?
Options
- AThe file retrieval policy applied to the endpoints may restrict access to certain system or kernel
- BThe retrieval process is limited to 500 MB in total file size.
- CThe endpoint agents were in offline mode during the file retrieval process, causing some files to
- DThe analyst must manually retrieve kernel files by accessing the machine directly.
How the community answered
(58 responses)- A60% (35)
- B24% (14)
- C5% (3)
- D10% (6)
Explanation
File retrieval in XSIAM/XDR honors the endpoint's retrieval policy. If that policy excludes sensitive areas (like system or kernel files), those items will not be collected, resulting in an incomplete set.
Topics
Community Discussion
No community discussion yet for this question.