Which response action in Cortex XDR allows a SOC analyst to remotely access an endpoint’s command-line interface to perform manual forensic data collection or system remediation?
Live Terminal is a powerful forensic and remediation tool built directly into the Cortex XDR and XSIAM consoles.
Direct Access: It provides a secure, web-based terminal session to a remote endpoint (Windows, macOS, or Linux) without requiring RDP or SSH to be enabled on the target.
Capabilities: Analysts can browse the file system, terminate processes, download/upload files, and execute PowerShell or Bash commands.
Auditability: Every action taken during a Live Terminal session is logged and recorded, ensuring that there is a full audit trail for compliance and "chain of custody" purposes during an investigation.
Why others are incorrect: The Action Center (C) is where you monitor the status of pending or completed actions (like a scan or isolation request), but it is not the interface used to execute the commands themselves.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit