Which two metrics are highlighted in the Incidents Dashboard? (Choose two)

The Cortex XDR Incidents Dashboard is designed to provide a high-level, at-a-glance overview of the current incident landscape. Key performance indicators (KPIs) and metrics displayed by default widgets include the total number of open incidents and a breakdown of these incidents by their assigned severity (e.g., Low, Medium, High, Critical). This allows security managers and analysts to quickly assess the workload, prioritize critical incidents, and understand the overall threat level. These metrics are fundamental for situational awareness and resource allocation within a Security Operations Center (SOC).

C. Endpoint patch version is an asset or vulnerability management metric, not a primary incident response metric typically displayed on the main Incidents Dashboard.
D. Analyst training logs are administrative or human resources data and are not relevant to the real-time operational status of security incidents.

1. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Dashboards". The guide details the default widgets available for dashboards, including the Incidents Dashboard, which features "Open Incidents by Severity" and "New Incidents" widgets, directly corresponding to severity distribution and count.

2. Palo Alto Networks. (2023). Cortex XDR Incidents Page Overview. "Incidents Dashboard". This section of the documentation explicitly shows and describes the default widgets, which include "Open Incidents by Severity" and other count-based metrics.