In the Endpoint Data context menu of the Cortex XSIAM endpoints table, where will an analyst be able to determine which users accessed an endpoint…

A Live Terminal session is an administrative action initiated by an analyst through the Cortex XSIAM console. All such actions are audited and recorded in the Action Center. The "View Actions" option in the endpoint's context menu provides a filtered view of the Action Center, specifically showing all actions performed on that endpoint. This log includes the action type (Live Terminal), the timestamp, and the user who initiated the session, directly answering the question of who accessed the endpoint.

A. View Endpoint Policy: This option displays the security policies (e.g., malware, exploit profiles) applied to the endpoint, not a log of administrative actions.

B. View Endpoint Logs: This shows security event logs collected by the Cortex agent on the endpoint itself, not the centralized audit trail of analyst-initiated actions.

C. View Incidents: This displays security incidents associated with the endpoint. A Live Terminal session is an administrative tool, not inherently an incident.

1. Palo Alto Networks, Cortex XSIAM Administrator Guide: In the "Action Center" section, it states, "The Action Center provides a single location where you can view the status of actions that you and other administrators in your tenant initiated on the endpoints in your organization." It lists "Live Terminal" as a supported action and the table of actions includes a column for "Action By" to identify the user.

2. Palo Alto Networks, Cortex XSIAM Administrator Guide: In the "Live Terminal" section, under "Get Started with Live Terminal," the documentation specifies, "Cortex XSIAM audits all commands and user activity during a Live Terminal session. To review the activity for a specific session, you can view the actions in the Action Center." This confirms that the Action Center, accessed via "View Actions," is the designated location for this audit trail.