To create a BIOC rule with XQL query you must at a minimum filter on which field inorder for it to be a valid BIOC rule?

To create a BIOC rule with XQL query you must at a minimum filter on which field inorder for it to be a valid BIOC rule?
A . causality_chain
B . endpoint_name
C . threat_event
D . event_type

View Answer

Answer: D

Explanation:

Reference: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html