What type of report helps CISOs understand overall XDR performance?

An Executive Summary report is specifically designed for a high-level audience like a CISO. This type of report synthesizes vast amounts of technical security data into concise, business-relevant metrics and trends. It typically includes key performance indicators (KPIs) such as mean time to resolve (MTTR), incident volume over time, top threat categories, and overall security posture improvements. This allows executives to quickly grasp the effectiveness of the security operations program and the performance of the XDR platform without needing to delve into granular technical details, facilitating strategic decision-making and resource allocation.

B. Lookup table exports are raw data lists used for technical analysis or data enrichment, not a high-level summary for executive review.
C. Query Library output provides the raw results of a specific technical query, which is too granular and lacks the context required by a CISO.
D. A schema browser snapshot is a technical reference detailing the structure of the data model, intended for analysts writing queries, not for executive reporting.

1. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Reports". This section details the various report types available, including the "Executive Summary" report, and describes its purpose to provide a high-level overview of incidents and endpoint status for management.

2. Palo Alto Networks. (2023). Cortex XDR Reporting. "Create a New Report". The documentation outlines the templates available, where the Executive Summary template is explicitly listed as a pre-configured option for summarizing key metrics for a leadership audience.