4.2 Use XDMs to Analyze Security Events XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–18

1. 16foundation · easy

   During an investigation, an analyst needs to see all processes that were created by a specific parent process. Which XDM field should be used to filter for the parent process name?

   • Axdm.target.process.name
   • Bxdm.actor.process.name
   • Cxdm.process.parent.name
   • Dxdm.process.name
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An analyst wants to detect all events where a user logged in from an external IP address. Which XDM fields should be used in the query?

   • Axdm.observer.ip and xdm.event.type
   • Bxdm.user.name and xdm.destination.ip
   • Cxdm.source.ip and xdm.source.is_external
   • Dxdm.actor.process.name and xdm.target.ip
   Reveal Solution Discussion Select an answer first
3. 18application · medium

   A security analyst is creating a detection rule for a new malware signature. The rule should trigger when a specific file hash is observed on any endpoint. The analyst has the hash value 'a1b2c3d4e5f6...'. Which XDM field should be used in the detection rule to match the file hash?

   • Axdm.actor.file.hash
   • Bxdm.source.file.hash
   • Cxdm.target.file.hash
   • Dxdm.observer.file.hash
   Reveal Solution Discussion Select an answer first