Cortex XDR provides a robust reporting engine designed to communicate security posture and incident trends to various stakeholders.
* Security and Delivery (A): When scheduling a report, an administrator can choose to send it via email.
To comply with corporate security policies-since these reports may contain sensitive internal data like hostnames or user accounts-Cortex XDR allows the PDF version to be password protected .
* XQL-Driven Content (D): The foundation of Cortex XDR reporting and dashboarding is XQL (Cortex Query Language) . Reports are built by adding "Widgets." These widgets are essentially visual representations (charts, tables, or graphs) of an XQL query. When a report is generated, it captures the current state/screenshot of these XQL-based widgets to provide the data for the requested time period.
Why other options are incorrect:
* Option B: While you can send reports via email or download them, there is no native "push to intranet" (like a direct WebDAV or SharePoint push) feature built directly into the standard reporting module without external automation (like XSOAR).
* Option C: Mock data is a feature often used in Cortex XSOAR for building playbook layouts and dashboards before live data exists; however, in the context of Cortex XDR , reports are designed to reflect the actual telemetry and alerts stored in the Data Lake.