PCDRA Palo Alto Networks Certified Detection and Remediation Analyst Questions and Answers

preventing the victim from being able to access APIs to cripple infrastructure

denying traffic out of the victims network until payment is received

restricting access to administrative accounts to the victim

encrypting certain files to prevent access by the victim

There are a total of 689 Up To Date agents.

Agent Auto Upgrade was enabled but not on all endpoints.

Agent Auto Upgrade has not been enabled.

There are more agents in Pending status than InProgress status.

Syslog servers

Third-Party security devices

Cortex XDR agents

Palo Alto Networks Next-Generation Firewalls

There is one lowseverity incident.

Host shpapy_win10 had the most vulnerabilities.

There is one informational severity alert.

This is an actual output of the Top 10 hosts with the most malware.

dataset = xdr_data

| filterevent_sub_type = PROCESS_START and

action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

dataset = xdr_data

| filter event_type = PROCESS and

event_sub_type = PROCESS_START and

action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

dataset = xdr_data

| filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

| fields action_process_image

dataset = xdr_data

| filter event_behavior = true

event_sub_type = PROCESS_START and

action_process_image_name ~=".*?\.(?:pdf|docx)\.exe"

Netflow Collector

Syslog Collector

DB Collector

Pathfinder