Which of the following alert sources can provide identity-based alerts?

Cortex XDR integrates with directory services like Active Directory and Azure AD to ingest user and authentication data. This integration is the foundation for the Identity Analytics and Identity Threat Detection and Response (ITDR) modules. By analyzing this identity-specific data, Cortex XDR can generate alerts for anomalous user behavior, such as impossible travel, unusual login times, or brute-force attempts. These are fundamentally identity-based alerts that originate from the directory services data source.

B. DNS sinkhole feeds: These provide data on malicious domains for network-based alerts, not user identity information.
C. Endpoint AV engines: These generate malware-related alerts on a specific host but do not serve as the primary source for identity-based behavioral alerts.
D. Broker VM logs: The Broker VM is a log forwarder; while it can forward logs containing identity data, the original source of that data is the directory service.

Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Configure Cortex XDR to Monitor Your Directory Service". This section details how to "forward your directory service logs to Cortex XDR to identify credential-based attacks."

Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Identity Analytics". The documentation states, "Cortex XDR Identity Analytics analyzes user behavior from your directory services logs to detect anomalies."