[Detection Engineering] An XDR engineer is creating a correlation rule to monitor login activity on specific systems. When the activity is identified, an alert is created. The alerts are being generated properly but are missing the username when viewed. How can the username information be included in the alerts?

In a Cortex XDR correlation rule, the XQL query retrieves data, but for that data to appear in the resulting alert, it must be explicitly mapped to the alert's schema. The "Alert Fields Mapping" section of the correlation rule configuration is used for this purpose. To include the username, the engineer must map the username field from the query results to a corresponding standard or custom field in the alert layout, such as actionlocaluser.

A. MITRE ATT&CK mapping is for tactical and technical classification of an alert; it does not add or modify data fields within the alert.
B. While the query must retrieve the username, this step alone is insufficient. Without mapping, the field will not be populated in the final alert.
D. A drill-down query is an investigative tool run after an alert is generated; it does not add information to the original alert record itself.

1. Palo Alto Networks, Cortex XDR Administrator's Guide, "Correlation Rules". The section on creating a correlation rule details the "Alert Layout" step, which includes "Alert Fields Mapping" to populate alert fields from the query results.