A suspicious domain is repeatedly showing in alerts. What actions would escalate response?
(Choose two)
Response:

What is the causality chain used for in Cortex XSIAM investigations?
Response:

In Cortex XSIAM, what initiates the execution of a playbook?
Response:

An endpoint is showing inconsistent behavior and policy non-compliance. What two actions should an analyst take?
Response:

Match each XQL feature with its function:
Feature
A) Query Library
B) XQL Helper
C) Scheduled Queries
D) Schema Viewer
Function
1. Provides reusable query templates
2. Supports query syntax and field completion
3. Executes queries at defined intervals
4. Displays dataset field structure and types
Response: