In Cortex XSIAM, the Live Terminal feature allows analysts to initiate an interactive command-line session with an endpoint directly from the management console. During an investigation, analysts can use Live Terminal to issue commands--including those that terminate suspicious or malicious processes running on the endpoint.
"Live Terminal provides analysts with a direct command line on the endpoint, enabling actions such as process termination during investigations."

The cytool protect enablecommand re-enables protection modules (files, processes, registry, services) on an endpoint where Cortex XDR agent protection had been paused using cytool protect disable.

On-demand scan findings are reported in the scan results but don't create Cortex XSIAM/XDR alerts, so "View related alerts" returns none.

Executing core pack commands in the Playground - either by typing them in the CLI or selecting them from Command & Scripts - lets you test and view results without writing anything to an incident's War Room audit trail.