3.2 Develop Plans to Integrate Existing Detection Rules and Automation Use Cases from Legacy SIEM to Cortex XSIAM SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team is mapping a legacy SIEM rule that detects a single failed login event for a privileged account. The rule is simple and does not correlate with other events. What is the most appropriate Cortex XSIAM detection mechanism to map this rule to?

   • AA machine learning model that profiles normal login behavior for privileged accounts.
   • BA scheduled search that runs every hour and looks for failed logins in the last hour.
   • CA custom detection rule that triggers on the specific event and account criteria.
   • DA correlation rule that chains multiple failed login events over a time window.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is translating a complex legacy SIEM automation workflow into a Cortex XSIAM playbook. The legacy workflow uses a custom script to query an external threat intelligence API, enrich the alert, and then conditionally block an IP address on the firewall. The team is concerned about the playbook's reliability and maintainability. What is the best approach for translating this workflow?

   • ARecreate the workflow using XSIAM playbook steps, integrating with the threat intelligence API and firewall, and implementing the conditional logic with native playbook actions.
   • BCreate a separate playbook for each step of the workflow and chain them together.
   • CEmbed the entire legacy custom script into a single Python step within the XSIAM playbook.
   • DManually perform the threat intelligence lookup and firewall block, and only use the playbook for alert creation.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of creating documentation for integrated detection rules and automation in Cortex XSIAM?

   • ATo satisfy regulatory compliance requirements
   • BTo provide a record for the migration project's closure
   • CTo replace the need for training
   • DTo enable operational teams to manage and maintain the integrated capabilities
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is migrating its detection rules from a legacy SIEM to Cortex XSIAM. The team has a rule that detects a specific sequence of failed logins followed by a successful login from a different geographic location. The legacy rule uses a complex regular expression and a lookup table of known-bad IP addresses. The team wants to replicate this logic in XSIAM. What is the most appropriate XSIAM detection mechanism to implement this rule?

   • AA scheduled search that runs every hour and queries for the login pattern in the raw log data.
   • BA machine learning model trained on historical login data to identify anomalous geographic jumps.
   • CA single custom rule that uses a regular expression to parse the entire log entry and trigger on the pattern.
   • DA correlation rule that chains the failed login events and the successful login event, and uses a custom indicator feed for the known-bad IP addresses.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is planning the migration of automation use cases from a legacy SIEM to Cortex XSIAM. One use case automatically blocks an IP address on the firewall for 24 hours when a specific alert is triggered. The team is assessing this use case for applicability in XSIAM. What is the primary consideration when translating this use case into an XSIAM playbook?

   • AWhether the XSIAM playbook can integrate with the firewall's API to execute the block action.
   • BWhether the legacy SIEM's alert format can be exactly replicated in the XSIAM alert schema.
   • CWhether the 24-hour block duration can be configured as a static value in the playbook.
   • DWhether the playbook can be scheduled to run at the same frequency as the legacy SIEM automation.
   Reveal Solution Discussion Select an answer first