Which feature allows analysts to generate customized reports in Cortex XDR?

The Report Scheduler is the specific feature within Cortex XDR designed for generating and distributing customized reports. This functionality allows administrators and analysts to create report templates based on predefined or custom XQL queries. They can then schedule these reports to run at regular intervals (e.g., daily, weekly, monthly) and automatically email them to designated recipients. This automates the process of security reporting for compliance, operational reviews, and executive summaries.

A. The Incident Query Builder is used for ad-hoc searching and filtering of incidents, not for creating scheduled, formatted reports.

B. The Event Aggregation Engine is an internal, backend process that correlates and groups related logs into alerts; it is not a user-facing reporting tool.

D. The Alert Reduction Filter is a feature for tuning and suppressing alerts to reduce noise, which is unrelated to generating customized reports.

1. Palo Alto Networks, Cortex XDR Administrator’s Guide. "Manage Dashboards and Reports". This section details the process to "Schedule a New Report," explaining how users can define the report's content, format (PDF, CSV), frequency, and recipients.

2. Palo Alto Networks, Cortex XDR Administrator’s Guide. "Reports". This chapter provides a comprehensive overview of creating, managing, and scheduling reports, stating, "Cortex XDR enables you to schedule reports to run on a recurring basis and email the reports to specific recipients."