Okay, I’ll be the one to say it because I’m genuinely trying to learn here. I’ve been testing Cortex XDR for my company over the last month, and everyone keeps talking about the AI chat feature.
But honestly? I find myself just going back to the query builder every single time. The chat feels like a gimmick. When I ask it something like “show me recent malware events,” it gives me a broad answer and sometimes even a pre-built query, but I have no idea *how* it got there. With the query builder, I can see the exact fields, operators, and logic. It feels like I’m actually learning how the data works.
Maybe I’m using it wrong? I’m new to this level of security software, and my team is counting on me to give a solid recommendation. For those of you with more experience, is the AI chat something you rely on, or is it more of a beginner-friendly tool you grow out of?
I can see it being useful for brainstorming alert names or something, but for actually finding what I need, the transparency of building a query step-by-step just works better for my brain. Am I missing its real purpose?