What are two reasons incident investigation is needed in Cortex XDR?

No solution will stop every attack requiring further investigation of activity.

Insider Threats may not be blocked and initial activity may go undetected.

Analysts need to acquire forensic artifacts of malware that has been blocked by the XDR agent.

Detailed reports are needed for senior management to justify the cost of XDR.