When creating a BIOC rule, which XQL query can be used?

When creating a BIOC rule, which XQL query can be used?
A . dataset = xdr_data
| filterevent_sub_type = PROCESS_START and
action_process_image_name ~= ".*?.(?:pdf|docx).exe"
B . dataset = xdr_data
| filter event_type = PROCESS and
event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?.(?:pdf|docx).exe"
C . dataset = xdr_data
| filter action_process_image_name ~= ".*?.(?:pdf|docx).exe"
| fields action_process_image
D . dataset = xdr_data
| filter event_behavior = true
event_sub_type = PROCESS_START and
action_process_image_name ~=".*?.(?:pdf|docx).exe"

View Answer

Answer: B

Explanation:

Reference: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html