Which two scenarios best fit using pre-defined query templates? (Choose two)

Pre-defined query templates in Cortex XDR are designed to streamline common and recurring investigation or hunting scenarios. Searching for activity related to a specific hash or investigating common security events like failed logins are frequent tasks for a SOC analyst. Templates for these scenarios provide a ready-made query structure, saving time and ensuring a consistent investigative approach. They allow analysts to quickly populate specific values (like a hash or username) into a complex query without having to build it from scratch each time.

C. Building a custom query from scratch is the opposite of using a pre-defined template; it involves manual construction of the query logic.
D. Automating remediation actions is handled by features like scripting, API integrations, or Cortex XSOAR playbooks, not by XQL query templates.

1. Palo Alto Networks, "Cortex XDR Investigator's Guide", docs.paloaltonetworks.com. The "Query Builder" section describes using both pre-defined and custom queries. Pre-defined queries are shown for common use cases like "Search for a specific file hash" and "Search for failed login attempts," illustrating their purpose for frequent, standardized searches.