Investigate endpoint alerts in Cortex XDR: causality chains, threat hunting with XQL, and incident response workflows.