Paloalto Networks Security Operations XSIAM-Analyst Question # 14 Topic 2 Discussion

The correct answer isB. The malware scan action detects malicious files but does not generate alerts for them.

In Cortex XSIAM and XDR, an on-demand malware scan effectively identifies malicious files on an endpoint. However, such scans typically record their findings directly in the scan results without generating separate alerts. Alerts are generally created through real-time protection mechanisms or detection rules, not through manually triggered scans.

Exact Reference from Official Document:

"The on-demand malware scan capability is designed to detect and identify malicious files but does not automatically generate alerts for those files. Alerts are primarily generated through real-time endpoint protection policies and detection rules."

Therefore, the absence of alerts despite successful malware detection is due to the designed behavior of on-demand scans.

=====================