Which two benefits come from scheduling queries? (Choose two)

Scheduling queries automates the process of running a specific XQL query on a recurring basis. This provides two key benefits. First, it enables continuous monitoring for specific threats or behaviors without requiring constant manual intervention. An analyst can write a query for a new threat actor's TTP and schedule it to run hourly. Second, this automation directly reduces the manual workload on the security team, freeing up analysts from repetitive threat hunting tasks to focus on more complex investigations and analysis.

C. Scheduled queries are for detection and monitoring; they do not perform response actions like resolving alerts. Alert resolution is handled by other features like automation rules.
D. Custom dashboards are created in the dashboard interface. While a dashboard widget runs a query, scheduling a query in the Query Center is a separate function for automated hunting.

1. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Query Center -> Schedule a Query". The documentation states that scheduling queries allows you to "run important queries on a recurring basis" to automate monitoring and threat hunting.

2. Palo Alto Networks. (2023). Cortex XDR for Analysts. "Automated Threat Hunting". This course material often describes scheduled queries as a primary method for operationalizing threat intelligence and automating routine hunting tasks, thereby reducing manual effort and ensuring consistent monitoring.