During identity-based investigations, analysts should primarily check for:

In an identity-based investigation, the focus is on the user account and its associated activities. Therefore, the primary artifacts to check are authentication anomalies. These include events such as logins from unusual geographic locations (impossible travel), multiple failed login attempts followed by a success, use of compromised credentials, or unusual privilege escalation. Cortex XDR's Identity Analytics and User View are specifically designed to surface these types of identity-centric anomalies, providing a clear starting point for the investigation by highlighting abnormal user behavior.

A. File system changes are endpoint artifacts, relevant to what a user did, but secondary to the initial identity compromise indicators.
C. DNS request patterns are network artifacts that can be useful but are not the primary indicator of an identity-specific threat like credential abuse.
D. Service restarts are endpoint events that are generally not a primary focus for an investigation centered on user identity and authentication.

1. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Identity Analytics". This section details how Cortex XDR analyzes user behavior to detect anomalies, focusing on "authentication events and user access to assets" to identify suspicious activity.

2. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Users View". The documentation explains that this view provides a "user-centric picture of events," highlighting risky users based on login behavior and other identity-related analytics.