thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Causality Chain

In Cortex XDR, the sequence of related processes and events from the root cause to the alert, shown in the Causality View.

Definition

The causality chain traces activity back to the Causality Group Owner (CGO), the process responsible for starting the chain of malicious activity. The Causality View shows process trees, network connections, file and registry actions, helping analysts determine root cause and scope.

Example

Viewing that outlook.exe launched winword.exe, which spawned powershell.exe that contacted a C2 domain.

Exam tip

The CGO is the root process of the chain; know this Cortex-specific term.

Related terms