Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA - Cortex XDR) Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  The response is now : If an incident contains only alerts with exclusions, Cortex XDR changes the incident status from New to Resolved - Auto Resolve and updates the resolve comment to Auto-resolved.

• Chose D1

  I agree it is D in the admin guide link

• 1

  D - "If an incident contains only alerts with exclusions, Cortex XDR changes the incident status to Resolved - False Positive and sends an email notification to the incident assignee (if set)." Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-an-Alert-Exclusion-Rule