Exam SecOps-Pro Topic 1 Question 7 Discussion

Actual exam question for Palo Alto Networks's SecOps-Pro exam
Question #: 7
Topic #: 1
Which scripting language would create a custom widget in Cortex XDR that shows the top five accounts with failed Windows logons in the past 24 hours?

Suggested Answer: A Vote an answer

XQL (Cortex Query Language) is the proprietary search and processing language used across the Palo Alto Networks Cortex ecosystem (XDR and XSIAM).
* Purpose: XQL is used to query the massive datasets stored in the Cortex Data Lake. It allows analysts to filter, aggregate, and transform raw logs into meaningful insights.
* Custom Widgets: To create a dashboard widget (like a bar chart or table), an analyst must write an XQL query to fetch the data. For example, to find failed logons, the query would target dataset = xdr_data, filter by event_type = AUTHENTICATION, and use an aggregate function to count and sort the "Top 5" results.
* Why others are incorrect: While Python (C) can be used for automation scripts in XSOAR/XSIAM, and PowerShell (D) is used for endpoint management, they are not used to query the data lake for dashboarding purposes.

by Richard at Apr 12, 2026, 01:16 PM

Limited Time Offer

15%

Off

Get Premium SecOps-Pro Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10