問題文
An organization is satisfied with the platform that collects and correlates its records and with the detections written on top of it. Its only complaint is that the steps analysts take after each alert are inconsistent and slow. Which product's role matches that complaint?
選択肢
- Cortex Xpanse, because the assets involved in each alert have to be identified before any of the steps that follow the alert can be carried out consistently.
- Cortex XSOAR, because the complaint concerns what happens after an alert rather than how the records are collected or how the alert was produced.
- Cortex XSIAM, because a complaint about the work that follows an alert is ultimately a complaint about the platform on which that work is carried out, and replacing the collection and correlation layer therefore addresses it at its source.
- Cortex XDR, because the steps that follow an alert are carried out on the endpoints where the activity was seen, so the endpoint platform owns them.