Which visualization helps identify peaks in suspicious activity over time?

Timeline charts, which are a fundamental component of Cortex XDR dashboards, are specifically designed to plot event data over a time axis. This visualization is the most effective method for an analyst to observe trends, patterns, and anomalies, such as sudden peaks or spikes in suspicious activity. These charts provide an immediate visual summary of event frequency, which is critical for monitoring and initial investigation.

B. Lookup tables are static datasets used for data enrichment during queries; they are not a form of time-series visualization.
C. Schema definitions describe the structure and fields of a dataset for query purposes, not a visual tool for analyzing activity.
D. Exclusion logs are textual records of ignored events and do not offer a graphical representation of activity trends over time.

1. Palo Alto Networks, "Cortex XDR Administrator's Guide," Chapter: Dashboards. This chapter describes the use of dashboard widgets, including time-based charts like "Incidents Over Time," to "help you visualize and monitor activity."

2. Palo Alto Networks, "Cortex XDR Dashboard and Reports Reference," Section: Dashboard Widgets. This reference details the "Alerts Over Time" widget, explaining it displays "the number of alerts over the selected time period," which directly enables the identification of peaks.