3.2 Develop Plans to Integrate Existing Detection Rules and Automation Use Cases from Legacy SIEM to Cortex XSIAM SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security operations team is migrating from a legacy SIEM to Cortex XSIAM. The team has exported all detection rules from the legacy SIEM into a spreadsheet. During the inventory review, the team notices that several rules reference log sources that are not currently being ingested into Cortex XSIAM. The team needs to ensure the migrated rules will have the data they require. What should the team do first?

   • APrioritize the migration of rules that do not depend on the missing log sources and defer all others indefinitely.
   • BMigrate all rules as-is and rely on the XSIAM parser framework to automatically normalize any incoming legacy log format.
   • CReplace the affected rules with generic XSIAM correlation rules that use built-in data sources only.
   • DCreate the missing log source integrations in Cortex XSIAM and map the legacy log formats to the XSIAM data model before migrating the affected rules.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is translating a legacy SIEM automation workflow into a Cortex XSIAM playbook. The legacy workflow performs the following steps: 1) Create a ticket in ServiceNow, 2) Send an email to the on-call analyst, 3) Wait for 15 minutes, 4) Check if the incident is resolved, and 5) Escalate to a manager if not resolved. What is the most important consideration when translating this workflow into an XSIAM playbook?

   • AVerifying that the playbook can be triggered by the same alert type as the legacy workflow.
   • BRecreating the exact 15-minute wait time as a static delay in the playbook.
   • CEnsuring the playbook can integrate with ServiceNow and the email system, and can implement the conditional wait-and-check logic.
   • DConfirming that the playbook runs on a schedule that matches the legacy workflow's polling interval.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When planning the integration of automation use cases into Cortex XSIAM, what is the purpose of considering operational dependencies?

   • ATo identify which use cases can be deleted
   • BTo reduce the number of use cases that need to be migrated
   • CTo ensure that use cases are migrated in an order that does not break dependent workflows
   • DTo determine the cost of each use case
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is migrating from a legacy SIEM to Cortex XSIAM. The legacy SIEM ingests logs from a custom application in a unique JSON format. The team has written a parser for this format in XSIAM, but during validation, they find that some fields are not being populated correctly, causing a critical detection rule to miss events. The team needs to resolve this issue. What is the most effective approach?

   • ATroubleshoot the parser by comparing the raw log samples with the parsed output in XSIAM and adjust the parser logic to correctly map the fields.
   • BRequest that the application vendor change the log format to match the XSIAM standard schema.
   • CIngest the raw JSON logs into a separate data store and have the rule query that store directly.
   • DModify the detection rule to use a different field that is being populated correctly.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When translating a legacy playbook that uses a specific integration (e.g., ticketing system), what must you verify in Cortex XSIAM?

   • AThat the playbook has fewer steps than the original
   • BThat the playbook is written in the same scripting language
   • CThat the same integration is available and configured in XSIAM
   • DThat the playbook uses only manual triggers
   Reveal Solution Discussion Select an answer first