Exam XSIAM-Engineer Topic 3 Question 66 Discussion
Actual exam question for Palo Alto Networks's XSIAM-Engineer exam
Question #: 66
Topic #: 3
Question #: 66
Topic #: 3
In which two locations can correlation rules be monitored for errors? (Choose two.)
Suggested Answer: A,B Vote an answer
Correlation rule errors can be tracked in XDR Collector audit logs (type = Rules, subtype = Error) and by querying the correlations_auditing dataset through XQL. These provide visibility into execution issues and failures for correlation rules.
by Merlin at May 25, 2026, 10:40 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).