3.2 Develop Plans to Integrate Existing Detection Rules and Automation Use Cases from Legacy SIEM to Cortex XSIAM SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 7)

Questions 31–33

1. 31foundation · easy

   During the assessment of a legacy automation use case, which factor is most important for determining whether it can be adapted to Cortex XSIAM?

   • AThe programming language used to write the original script
   • BThe number of steps in the workflow
   • CThe age of the use case
   • DThe availability of equivalent playbook actions and triggers in XSIAM
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A large organization is migrating from a legacy SIEM to Cortex XSIAM. The team has discovered that the legacy SIEM contains rules that were created by different teams over several years, with inconsistent naming conventions and no clear ownership. Some rules are critical, while others are experimental. The team needs to build a migration plan. What is the most critical first step to ensure a successful migration?

   • AStart migrating all rules to XSIAM and then clean up the duplicates and obsolete rules afterward.
   • BContact the original rule authors to ask them to document their rules before migration.
   • CConduct a comprehensive inventory and classification of all rules, including their logic, data sources, status, and business owner.
   • DMigrate the rules that are easiest to translate to XSIAM first to build momentum.
   Reveal Solution Discussion Select an answer first
3. 33foundation · easy

   During the initial phase of migrating from a legacy SIEM to Cortex XSIAM, what is the primary purpose of creating a comprehensive inventory of existing detection rules?

   • ATo determine which rules are no longer needed due to changes in the threat landscape
   • BTo provide a list of rules for the security team to manually recreate in XSIAM
   • CTo catalog the logic, data sources, and metadata of each rule for migration planning
   • DTo identify which rules can be immediately decommissioned without review
   Reveal Solution Discussion Select an answer first