Live Terminal uses the WebSocket protocol to communicate with the agent on the endpoint.

WebSocket is a full-duplex communication protocol that enables bidirectional data exchange

between a client and a server over a single TCP connection. WebSocket is designed to be

implemented in web browsers and web servers, but it can be used by any client or server

application. WebSocket provides a persistent connection between the Cortex XDR console and the

endpoint, allowing you to execute commands and receive responses in real time. Live Terminal uses

port 443 for WebSocket communication, which is the same port used for HTTPS traffic. Reference:

Initiate a Live Terminal Session

WebSocket

Unit 42 is the threat intelligence and response team of Palo Alto Networks. The purpose of Unit 42 is

to collect and analyze the most up-to-date threat intelligence and apply it to respond to cyberattacks.

Unit 42 is composed of world-renowned threat researchers, incident responders and security

consultants who help organizations proactively manage cyber risk. Unit 42 is responsible for threat

research, malware analysis and threat hunting, among other activities12.

Let’s briefly discuss the other options to provide a comprehensive explanation:

A) Unit 42 is not responsible for automation and orchestration of products. Automation and

orchestration are capabilities that are provided by Palo Alto Networks products such as Cortex

XSOAR, which is a security orchestration, automation and response platform that helps security

teams automate tasks, coordinate actions and manage incidents3.

B) Unit 42 is not responsible for the configuration optimization of the Cortex XDR server. The Cortex

XDR server is the cloud-based platform that provides detection and response capabilities across

network, endpoint and cloud data sources. The configuration optimization of the Cortex XDR server

is the responsibility of the Cortex XDR administrators, who can use the Cortex XDR app to manage

the settings and policies of the Cortex XDR server4.

C) Unit 42 is not responsible for the rapid deployment of Cortex XDR agents. The Cortex XDR agents

are the software components that are installed on endpoints to provide protection and visibility. The

rapid deployment of Cortex XDR agents is the responsibility of the Cortex XDR administrators, who

can use various methods such as group policy objects, scripts, or third-party tools to deploy the

Cortex XDR agents to multiple endpoints5.

In conclusion, Unit 42 is the threat intelligence and response team of Palo Alto Networks that is

responsible for threat research, malware analysis and threat hunting. By leveraging the expertise and

insights of Unit 42, organizations can enhance their security posture and protect against the latest

cyberthreats.

Reference:

About Unit 42: Our Mission and Team

Unit 42: Threat Intelligence & Response

Cortex XSOAR

Cortex XDR Pro Admin Guide: Manage Cortex XDR Settings and Policies

Cortex XDR Pro Admin Guide: Deploy Cortex XDR Agents

A BIOC rule is a custom detection rule that uses the Cortex Query Language (XQL) to define the

behavior or actions that indicate a potential threat. A BIOC rule can use the xdr_data and

cloud_audit_log datasets and presets for these datasets. A BIOC rule can also use the filter stage,

alter stage, and functions without any aggregations in the XQL query. The query must return a single

field named action_process_image, which is the process image name of the suspicious process. The

query must also include the event_type and event_sub_type fields in the filter stage to specify the

type and sub-type of the event that triggers the rule.

Option B is the correct answer because it meets all the requirements for a valid BIOC rule query. It

uses the xdr_data dataset, the filter stage, the event_type and event_sub_type fields, and the

action_process_image_name field with a regular expression to match any process image name that

ends with .pdf.exe or .docx.exe, which are common indicators of malicious files.

Option A is incorrect because it does not include the event_type field in the filter stage, which is

mandatory for a BIOC rule query.

Option C is incorrect because it does not include the event_type and event_sub_type fields in the

filter stage, and it uses the fields stage, which is not supported for a BIOC rule query. It also returns

the action_process_image field instead of the action_process_image_name field, which is the

expected output for a BIOC rule query.

Option D is incorrect because it uses the event_behavior field, which is not supported for a BIOC rule

query. It also does not include the event_type field in the filter stage, and it uses the event_sub_type

field incorrectly. The event_sub_type field should be equal to PROCESS_START, not true.

Reference:

Working with BIOCs

Cortex Query Language (XQL) Reference

You can star security events in Cortex XDR in two ways: manually star an alert or an incident, or

create an alert-starring or incident-starring configuration. Starring security events helps you prioritize

and track the events that are most important to you. You can also filter and sort the events by their

star status in the Cortex XDR console.

To manually star an alert or an incident, you can use the star icon in the Alerts table or the Incidents

table. You can also star an alert from the Causality View or the Query Center Results table. You can

star an incident from the Incident View or the Query Center Results table. You can also unstar an

event by clicking the star icon again.

To create an alert-starring or incident-starring configuration, you can use the Alert Starring

Configuration or the Incident Starring Configuration pages in the Cortex XDR console. You can define

the criteria for starring alerts or incidents based on their severity, category, source, or other

attributes. You can also enable or disable the configurations as needed.

Reference:

Star Security Events

Create an Alert Starring Configuration

Create an Incident Starring Configuration

A supply chain attack is a type of cyberattack that targets a trusted third-party vendor who offers

services or software vital to the supply chain. Software supply chain attacks inject malicious code into

an application in order to infect all users of an app. The purpose of targeting software vendors in a

supply-chain attack is to take advantage of a trusted software delivery method, such as an update or

a download, that can reach a large number of potential victims. By compromising a software vendor,

an attacker can bypass the security measures of the downstream organizations and gain access to

their systems, data, or networks. Reference:

What Is a Supply Chain Attack? - Definition, Examples & More | Proofpoint US

What Is a Supply Chain Attack? - CrowdStrike

What Is a Supply Chain Attack? | Zscaler

What Is a Supply Chain Attack? Definition, Examples & Prevention