1.3 Configure Custom Prioritizations XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC team wants to create a custom prioritization rule that assigns 'low' priority to alerts from a specific test environment to reduce noise. The rule should only apply to alerts where the 'environment' custom field equals 'test'. What is the minimum set of fields that must be configured when creating this rule?

   • AName and priority level only.
   • BDescription, alert source selection, and priority level.
   • CCondition on 'environment' field and alert source selection.
   • DName, description, condition on 'environment' field, and priority level.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC analyst has just created a custom prioritization rule that assigns 'high' priority to alerts containing the 'malware-family: TrickBot' custom field. Before enabling the rule for all alert sources, the analyst wants to confirm it works as expected. What is the most efficient way to validate the rule?

   • AEnable the rule and wait for a real TrickBot alert to arrive to see if it gets prioritized.
   • BUse the built-in test feature to simulate an alert with the 'malware-family: TrickBot' field and verify the assigned priority.
   • CReview the rule's configuration in the management interface to confirm the conditions are correct.
   • DCreate a second rule with the same conditions and compare their behavior.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC manager notices that a custom prioritization rule created several months ago is now assigning 'high' priority to a large number of alerts that are no longer considered critical. The rule is still valid for some alert types but is too broad. What should the manager do to address this?

   • ALeave the rule as is and manually re-prioritize the affected alerts.
   • BDelete the rule and create a new one from scratch.
   • CEdit the existing rule to narrow its conditions and reduce the priority level.
   • DDisable the rule and rely on default prioritization.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   An analyst is constructing a new custom prioritization rule. What is the first step in the creation process?

   • AProvide a name and description for the rule
   • BSelect the alert sources to which the rule applies
   • CSpecify the priority level to assign
   • DDefine the conditions that the rule will match
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses XSIAM to monitor alerts from its EDR, firewall, and cloud security tools. The team wants to create a custom prioritization that only applies to alerts from the EDR and firewall sources, not the cloud security tool. What is the correct way to configure this in the prioritization rule?

   • ASpecify both 'EDR' and 'Firewall' as the alert sources in the rule's source selection.
   • BCreate two separate rules, one for each source, and leave the cloud security tool unassigned.
   • CSpecify 'Cloud Security' as an exclusion in the rule's conditions.
   • DApply the rule globally and then manually adjust priorities for cloud security alerts.
   Reveal Solution Discussion Select an answer first