A. Initiate automated response actions

B. Navigate to a different dashboard

C. Link to an XQL query

D. Send alerts to console users

A. Cloud Identity Engine

B. Cloud Inventory

C. Microsoft 365

D. Azure Network Watcher

A. IOC Expiration Policies

B. Response Action Rules

C. Local Analysis Engine

D. Dynamic Host Inventory

A. Group membership updates are based on real-time threat detection.

B. The selection criteria is limited to 10 and only the *wildcard can be used.

C. Group membership is limited to endpoint tags, partial hostnames and domains, and network information.

D. The endpoint must match an existing XDR agent, with a limit of 250 endpoints.

A. [COLLECT:vendor="vendor", product="product", target_dataset="", no_hit=drop] * drop _raw_log contains "undesired logs";

B. [COLLECT:vendor="vendor", product="product", target_brokers="", no_hit=drop] * drop _raw_log contains "undesired logs";

C. [INGEST:vendor="vendor", product="product", target_brokers="vendor_product_raw", no_hit=keep] * filter _raw_log not contains "undesired logs";

D. [INGEST:vendor="vendor", product="product",
target_dataset="vendor_product_raw",no_hit=drop] * filter _raw_log not contains "undesired logs";

A. Any application named Explorer.exe will bypass targeted modules for endpoints by using the Global Exceptions profile.

B. Once reenabled, Explorer.exe will bypass targeted modules for endpoints by using the Global Exceptions profile.

C. Signed application Explorer.exe from Microsoft will bypass targeted modules for all endpoints.

D. Signed application Explorer.exe from Microsoft will bypass modules for endpoints by using the Global Exceptions profile.

A. Fixed filters limit the data visible in widgets, while dashboard drilldowns allow users to download data from the dashboard in various formats

B. Fixed filters let users select predefined or dynamic values to adjust the scope, while dashboard drilldowns provide interactive insights or trigger contextual changes, like linking to XQL searches

C. Fixed filters allow users to select predefined data values, while dashboard drilldowns enable users to alter the scope of the data displayed by selecting filter values from the dashboard header

D. Fixed filters allow users to adjust the layout, while dashboard drilldowns provide links to external reports and/or dashboards

A. Conduct an XQL query for NGFW log data

B. Wait for an incident that involves the NGFW to populate

C. Retrieve device certificate from NGFW dashboard

D. Confirm that the selected device has a valid certificate

A. The XDR Collector is dropping the logs

B. The Broker VM is offline

C. The parsing rule corrupted the database

D. The filter stage is dropping the logs