3.4 Use Lookup Tables XDR-ANALYST Practice Questions (Page 5)

Questions 21–22

1. 21expert · hard

   An analyst is investigating a potential insider threat. They have a lookup table that maps employee IDs to their roles. The analyst runs a query to join the authentication logs with this table. The query returns a large number of events where the role is null. What is the most likely reason for the null values?

   • AThe analyst used the wrong field for the join, such as username instead of employee ID.
   • BThe authentication logs contain employee IDs that are not present in the lookup table.
   • CThe lookup table is too large and the query timed out before processing all events.
   • DThe role field in the lookup table is defined with the wrong data type.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In an XDR query, what is the primary way to apply a lookup table to enrich events?

   • ABy modifying the event schema to include the table's fields
   • BBy creating a new dataset that duplicates the event data
   • CBy using the 'lookup' command to join the table with the event data
   • DBy exporting the events to a CSV and merging them manually
   Reveal Solution Discussion Select an answer first