Which two methods are used by Cortex XDR to group alerts into incidents? (Choose two)

Cortex XDR employs sophisticated methods to group disparate alerts into cohesive incidents. The primary method is data stitching based on common entities (A), where the system links alerts that share attributes like a hostname, username, IP address, or file hash. A more specific technique is the use of shared session identifiers (C). This includes causality group IDs, which track parent-child process relationships, and network session IDs. These identifiers allow Cortex XDR to group all events and alerts that are part of the same execution chain or communication flow, providing a complete narrative of an attack.

B. Alert starring by analysts: Starring is a manual user interface feature for bookmarking or flagging alerts; it is not an automated grouping method used by the Cortex XDR engine.
D. Random sampling: Random sampling is a statistical technique used for data analysis on large datasets and is not a valid method for grouping security alerts, which requires deterministic, evidence-based connections.

1. Palo Alto Networks, Cortex XDR Administrator's Guide, "Causality Analysis". This section explains, "To identify causal relationships between events, the Cortex XDR agent monitors process, file, network, and other activities... The agent then organizes the related events into causality chains." This supports both data stitching (A) and the use of specific identifiers (C).

2. Palo Alto Networks, Cortex XDR Agent Administrator's Guide, "Event Collection". The guide details the collection of data with unique identifiers for processes and network connections, which are the "shared session identifiers" used for grouping.