Palo Alto Networks Exam PCDRA Topic 12 Question 45 Discussion

Actual exam question for Palo Alto Networks's PCDRA exam

Question #: 45
Topic #: 12

[All PCDRA Questions]

How can you pivot within a row to Causality view and Timeline views for further investigate?

AUsing the Open Card Only

BUsing the Open Card and Open Timeline actions respectively

CYou can't pivot within a row to Causality view and Timeline views

DUsing Open Timeline Actions Only

Show Suggested Answer

Suggested Answer: B

To pivot within a row to Causality view and Timeline views for further investigation, you can use the Open Card and Open Timeline actions respectively. The Open Card action will open a new tab with the Causality view of the selected row, showing the causal chain of events that led to the alert. The Open Timeline action will open a new tab with the Timeline view of the selected row, showing the chronological sequence of events that occurred on the affected endpoint. These actions allow you to drill down into the details of each alert and understand the root cause and impact of the incident.Reference:

Cortex XDR User Guide, Chapter 9: Investigate Alerts, Section: Pivot to Causality View and Timeline View

PCDRA Study Guide, Section 3: Investigate and Respond to Alerts, Objective 3.1: Investigate alerts using the Causality view and Timeline view

by Frederica at Dec 21, 2023, 05:48 AM

Limited Time Offer

25%

Off

Get Premium PCDRA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Kristin

8 months ago

Yeah, that makes sense to me. The question is specifically asking about how to pivot within a row, so B seems like the most comprehensive answer.

upvoted 0 times

...

Alline

8 months ago

Okay, let's think this through. I'm leaning towards option B, as it seems to suggest we can use both the Open Card and Open Timeline actions to pivot between the views.

upvoted 0 times

...

Barb

8 months ago

Hmm, I think it has something to do with navigating between different views, but I'm not sure which option is the right one.

upvoted 0 times

...

8 months ago

Using the Open Card and Open Timeline actions respectively

upvoted 0 times

...