In Cortex XDR, the Device Configuration profile (an extension of the agent settings profile) controls how the Cortex XDR agent monitors and manages device-related activities, such as the mounting of removable drives. By default, the Device Configuration profile includes monitoring for device mount events, such as when a USB drive or other removable media is connected to an endpoint. These events are logged and can be accessed for investigations, such as detecting unauthorized drive usage in an insider compromise scenario.

Correct Answer Analysis (A) : The Host Inventory - > Mounts section in the Cortex XDR console provides a detailed view of mount events for each endpoint, including information about removable drives mounted on the system. This is the most straightforward place to find evidence of an unauthorized removable drive being mounted on the company laptop, as it aggregates device mount events captured by the default Device Configuration profile.

Why not the other options?

B. dataset = xdr_data | filter event_type = ENUM.MOUNT and event_sub_type = ENUM.MOUNT_DRIVE_MOUNT : This XQL query is technically correct for retrieving mount events from the xdr_data dataset, but it requires manual query execution and knowledge of specific event types. The Host Inventory - > Mounts section is a more user-friendly and direct method for accessing this data, making it the preferred choice for an engineer investigating this issue.

C. The requested data requires additional configuration to be captured : This is incorrect because the default Device Configuration profile already captures mount events for removable drives, so no additional configuration is needed.

D. preset = device_control : The device_control preset in XQL retrieves device control-related events (e.g., USB block or allow actions), but it may not specifically include mount events unless explicitly configured. The Host Inventory - > Mounts section is more targeted for this investigation.

Exact Extract or Reference:

The Cortex XDR Documentation Portal describes device monitoring: “The default Device Configuration profile logs mount events for removable drives, which can be viewed in the Host Inventory - > Mounts section of the console” (paraphrased from the Device Configuration section). The EDU-262: Cortex XDR Investigation and Response course covers investigation techniques, stating that “mount events for removable drives are accessible in the Host Inventory for endpoints with default device monitoring” (paraphrased from course materials). The Palo Alto Networks Certified XDR Engineer datasheet includes “maintenance and troubleshooting” as a key exam topic, encompassing investigation of endpoint events.

In Cortex XDR, a false positive alert involving OUTLOOK.EXE triggering a CGO (Codegen Operation) alert related to DWWIN.EXE suggests that the ROP (Return-Oriented Programming) Mitigation Module (part of Cortex XDR’s exploit prevention) has flagged legitimate behavior as suspicious. ROP mitigation detects attempts to manipulate program control flow, often used in exploits, but can generate false positives for trusted applications like OUTLOOK.EXE. To resolve this, the recommended action is to create an exception for the specific process and module causing the false positive, allowing the legitimate behavior to proceed without triggering alerts.

Correct Answer Analysis (D) : Create an exception for OUTLOOK.EXE for ROP Mitigation Module is the recommended action. Since OUTLOOK.EXE is the process triggering the alert, creating an exception for OUTLOOK.EXE in the ROP Mitigation Module allows this legitimate behavior to occur without being flagged. This is done by adding OUTLOOK.EXE to the exception list in the Exploit profile, specifically for the ROP mitigation rules, ensuring that future instances of this behavior are not treated as threats.

Why not the other options?

A. Create an alert exclusion for OUTLOOK.EXE : While an alert exclusion can suppress alerts for OUTLOOK.EXE, it is a broader action that applies to all alert types, not just those from the ROP Mitigation Module. This could suppress other legitimate alerts for OUTLOOK.EXE, reducing visibility into potential threats. An exception in the ROP Mitigation Module is more targeted.

B. Disable an action to the CGO Process DWWIN.EXE : Disabling actions for DWWIN.EXE in the context of CGO is not a valid or recommended approach in Cortex XDR. DWWIN.EXE (Dr. Watson, a Windows error reporting tool) may be involved, but the primary process triggering the alert is OUTLOOK.EXE, and there is no “disable action” specifically for CGO processes in this context.

C. Create an exception for the CGO DWWIN.EXE for ROP Mitigation Module : While DWWIN.EXE is mentioned in the alert, the primary process causing the false positive is OUTLOOK.EXE, as it’s the application initiating the behavior. Creating an exception for DWWIN.EXE would not address the root cause, as OUTLOOK.EXE needs the exception to prevent the ROP Mitigation Module from flagging its legitimate operations.

Exact Extract or Reference:

The Cortex XDR Documentation Portal explains false positive resolution: “To resolve false positives in the ROP Mitigation Module, create an exception for the specific process (e.g., OUTLOOK.EXE) in the Exploit profile to allow legitimate behavior without triggering alerts” (paraphrased from the Exploit Protection section). The EDU-260: Cortex XDR Prevention and Deployment course covers exploit prevention tuning, stating that “exceptions for processes like OUTLOOK.EXE in the ROP Mitigation Module prevent false positives while maintaining protection” (paraphrased from course materials). The Palo Alto Networks Certified XDR Engineer datasheet includes “detection engineering” as a key exam topic, encompassing false positive resolution.

The Identity Threat Detection and Response (ITDR) add-on in Cortex XDR enhances identity-based threat detection by integrating with the Cloud Identity Engine , which synchronizes user, group, and computer details from identity providers (e.g., Active Directory, Okta). For the Cloud Identity Engine to provide comprehensive identity data across regions, it must be properly configured and aligned with the Cortex XDR tenant’s region.

Correct Answer Analysis (A) : The issue is likely that the XDR tenant is not in the same region as the Cloud Identity Engine . Cortex XDR tenants are region-specific (e.g., North America, Europe), and the Cloud Identity Engine must be configured to synchronize data with the tenant in the same region. If the North American tenant is used but the European offices’ identity data is managed by a Cloud Identity Engine in a different region (e.g., Europe), the tenant may not receive user, group, or computer details for European users, causing the observed issue.

Why not the other options?

B. The Cloud Identity Engine plug-in has not been installed and configured : The question states that the Cloud Identity Engine has been onboarded, implying it is installed and configured. The issue is specific to European office data, not a complete lack of integration.

C. The Cloud Identity Engine needs to be activated in all global regions : The Cloud Identity Engine does not need to be activated in all regions. It needs to be configured to synchronize with the tenant in the correct region, and regional misalignment is the more likely issue.

D. The ITDR add-on is not compatible with the Cloud Identity Engine : The ITDR add-on is designed to work with the Cloud Identity Engine, so compatibility is not the issue.

Exact Extract or Reference:

The Cortex XDR Documentation Portal explains Cloud Identity Engine integration: “The Cloud Identity Engine must be configured in the same region as the Cortex XDR tenant to ensure proper synchronization of user, group, and computer details” (paraphrased from the Cloud Identity Engine section). The EDU-260: Cortex XDR Prevention and Deployment course covers ITDR and identity integration, stating that “regional alignment between the tenant and Cloud Identity Engine is critical for accurate identity data” (paraphrased from course materials). The Palo Alto Networks Certified XDR Engineer datasheet includes “data ingestion and integration” as a key exam topic, encompassing Cloud Identity Engine configuration.