XDR-ANALYST practice question 10 of 35

Which two processes occur when an analyst stars an alert? (Choose two)

Full set: 100 questions
Answer options
A: The alert is flagged for easy retrieval Correct answer
B: The alert becomes part of prioritized views Correct answer
C: The alert’s severity is permanently changed
D: The alert is deleted after 7 days
Correct Answer:
A. The alert is flagged for easy retrieval; B. The alert becomes part of prioritized views
Explanation

Starring an alert in the Cortex XDR console is a workflow management feature for analysts. When an alert is starred, it is marked with a star icon, making it easy to find again using the filter options in the alerts table. This allows an analyst to flag alerts of interest for follow-up. Consequently, by filtering for starred alerts, an analyst creates a prioritized view of items they are actively investigating or need to return to, separating them from the general queue of incoming alerts.

Why Incorrect

C. The alert’s severity is permanently changed: Starring is a non-destructive, user-specific flag for organization; it does not modify the underlying properties or severity of the alert itself.
D. The alert is deleted after 7 days: Starring is for bookmarking and prioritizing alerts, not for marking them for deletion or managing their lifecycle.

References

Palo Alto Networks. (2023). Cortex XDR Analyst Guide. "Manage Alerts". The guide explains the function of starring alerts: "Star an alert to easily locate it later. You can filter the alerts table to display only starred alerts." This directly supports options A and B as the purpose of easy retrieval is to create a prioritized view.

Scroll to Top