XSIAM-ENGINEER · Question #4
A vulnerability analyst asks a Cortex XSIAM engineer to identify assets vulnerable to newly reported zero-day CVE affecting the "ai_app" application and versions 12.1, 12.2, 12.4, and 12.5. Which XQL
The correct answer is C. preset = host_inventory_applications | filter application_name contains "ai_app" and version in ("12.1", "12.2", "12.4", "12.5"). The correct query is the preset = host_inventory_applications with filters for application_name contains "ai_app" and version in ("12.1", "12.2", "12.4", "12.5"). This directly identifies hosts that have the vulnerable application and specific versions installed, matching the ana
Question
A vulnerability analyst asks a Cortex XSIAM engineer to identify assets vulnerable to newly reported zero-day CVE affecting the "ai_app" application and versions 12.1, 12.2, 12.4, and 12.5. Which XQL query will provide the required result? A. B. C. D.
Exhibit
Options
- Adataset = va_cves | filter affected_products contains "ai_app" | fields affected_hosts, affected_products
- Bdataset = xdr_data | filter event_type = ENUM.PROCESS | filter action_process_image_name = "ai_app" | filter action_process_file_info not in ("12.1", "12.2", "12.4", "12.5")
- Cpreset = host_inventory_applications | filter application_name contains "ai_app" and version in ("12.1", "12.2", "12.4", "12.5")
- Ddataset = host_inventory | filter applicationName contains "ai_app" | filter applicationVersion not in ("12.1", "12.2", "12.4", "12.5")
How the community answered
(17 responses)- B6% (1)
- C82% (14)
- D12% (2)
Explanation
The correct query is the preset = host_inventory_applications with filters for application_name contains "ai_app" and version in ("12.1", "12.2", "12.4", "12.5"). This directly identifies hosts that have the vulnerable application and specific versions installed, matching the analyst's request to find assets exposed to the zero-day CVE.
Topics
Community Discussion
No community discussion yet for this question.