Which two alert sources typically provide network-level detections? (Choose two)

Network-level detections are derived from data sources that monitor traffic and communications between devices. Firewall traffic logs provide detailed records of network connections, policies, and threats traversing the network perimeter and internal segments. DNS sinkhole detections identify and redirect malicious domain name resolution requests at the network level, preventing endpoints from connecting to known malicious sites. Both are fundamental sources for network-based threat analysis within Cortex XDR.

B. Endpoint AV scans are a host-level security measure, analyzing files and processes directly on the endpoint, not on the network.
D. Active Directory logs provide information about user authentication and identity management, which are considered identity-level or host-level events, not network traffic analysis.

1. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Data Sources". This section explicitly lists "Palo Alto Networks NGFW logs" as a primary data source for monitoring network activity.

2. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Get Started with Analytics". The guide describes how Cortex XDR uses firewall logs to detect network-based attacks.

3. Palo Alto Networks. (2023). DNS Security Datasheet. This document describes DNS Sinkholing as a network-level feature that "identifies infected hosts on your network" by intercepting malicious DNS queries.