You notice multiple endpoints reporting offline in XSIAM. Which actions would help confirm their operational status?

Question

Options

• AReview recent heartbeat logs
• BPerform a live terminal scan
• CPing the endpoint from the agent
• DCheck agent connection timestamps

• A
  73% (24)
• B
  9% (3)
• C
  18% (6)

Explanation

Reviewing heartbeat logs (A) and checking agent connection timestamps (D) are correct because both rely on historical, passively-collected data already stored in XSIAM - they don't require the endpoint to be reachable right now. Heartbeat logs show the cadence of the agent's check-ins, revealing whether the silence is recent or prolonged, while connection timestamps pinpoint the exact moment contact was lost, helping distinguish a genuinely offline endpoint from a transient reporting gap.

Option B (live terminal scan) is wrong because it requires an active connection to the endpoint - if the endpoint is offline, the scan simply cannot execute, making it useless for diagnosis at this stage. Option C (ping from the agent) is wrong because XSIAM does not expose a console-initiated ping-from-agent workflow for status confirmation; it's also a network-layer check rather than an agent-health check, so it wouldn't tell you whether the Cortex agent itself is functional.

Memory tip: Think "passive before active" - when an endpoint is offline, start with data XSIAM already has (heartbeat logs, timestamps) before trying actions that need the endpoint to be reachable (scans, pings).

No community discussion yet for this question.