xdr-engineer Sample Questions & Answers

The correct flow for custom logs sent over TCP is to first receive them with a generic TCP Collector applet. Since the format is unique, a standard parser won't work. A custom Parsing Rule, typically using RegEx, must be applied to extract the fields. After parsing, the data is normalized to the XDR schema and then forwarded to the Cortex Data Lake. A Syslog Collector expects a specific syslog format, not a generic TCP stream. A Filebeat applet is used for collecting logs from files.

The 'Endpoint Administration' permission grants the ability to perform response actions on endpoints, such as isolation, termination of processes, and file retrieval. To create a view-only role for a Tier 1 Analyst, this permission must be withheld. Permissions like 'View Incidents' and 'Run Queries' are necessary for their investigative duties.

The requirement is to block inbound traffic from a specific subnet. Therefore, the rule must be configured with Action: Block, Direction: Inbound, and the Remote Address set to the guest Wi-Fi subnet 172.16.32.0/20. Since the default rule is typically 'Allow All', this specific block rule will take precedence for matching traffic, achieving the desired outcome.

This query correctly filters the xdr_data dataset for DNS lookup events from the specified host. The key part is and not (action_device_ip_address = "10.1.1.10" or action_device_ip_address = "10.2.1.10"), which accurately excludes queries directed to the internal DNS servers. action_device_ip_address is the field that contains the IP address of the DNS server that received the query.

The Broker VM uses Fluentd for its logging pipeline. When a parsing rule is applied, the results, including successful field extractions and any errors, are logged in the fluentd.log file on the Broker VM's file system. This log is the most direct place to verify the behavior of a custom parsing rule and diagnose issues with field extraction or data normalization.

The XDR Collector is the component designed to collect logs from cloud-native and SaaS sources where installing an agent is not possible. It can be configured to pull logs from services like AWS CloudWatch, which collects logs from AWS Lambda. The Broker VM is for on-premises collection, and the XDR agent cannot be installed directly into a serverless Lambda runtime environment.

When preparing a golden image for VDI or mass deployment, the Cortex XDR agent must be installed with the -vdi (or equivalent) flag. This action prevents the agent from registering with the console and generating a unique ID on the golden image itself. When a new endpoint is provisioned from this image, the agent will then perform its initial registration and receive a unique ID, preventing duplicate entries in the console.

First, a general blocking rule is needed. A Device Control Profile must be configured to block the 'USB Storage' device class to act as the default deny policy for all such devices.

After establishing the block rule, an exception is required. The Device Control Exceptions list allows administrators to specify unique identifiers (like serial numbers) of the company-issued USB drives that should be permitted, overriding the general block rule.

The 'Execution Timeout' is a safeguard mechanism. It sets the maximum amount of time that an automation rule is allowed to run after being triggered. This prevents a malfunctioning or long-running rule from consuming excessive system resources or getting stuck in a loop.

A Bar Chart Widget is the most suitable choice for visualizing categorical data like MITRE ATT&CK tactics. It can be configured to run an XQL query that groups alerts by tactic and displays the count for each tactic as a separate bar, providing an intuitive and easy-to-understand visual comparison for executives.