A customer wants to modify the retention periods of their Threat logs in Cortex Data Lake.
Where would the user configure the ratio of storage for each log type?
Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )