2.7 Differentiate Between Alert Grouping and Data Stitching XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC team is handling an incident that involves 20 alerts from different sources (firewall, endpoint, and email gateway) that are all related to a single phishing campaign. The team wants to create a single incident that includes all alerts and also provides a timeline of the attack. Which combination of actions should the team take?

   • AUse data stitching to consolidate the 20 alerts into one incident, then use alert grouping to add a timeline.
   • BUse alert grouping to consolidate the 20 alerts into one incident, then use data stitching to add a timeline of the attack from the correlated data.
   • CUse only alert grouping, as it will automatically provide the timeline.
   • DUse only data stitching, as it will automatically reduce the alert count.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In XSIAM, what does alert grouping primarily operate on?

   • ARaw log entries
   • BUser identities
   • CIndividual alerts
   • DNetwork packets
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the key difference between alert grouping and data stitching?

   • AAlert grouping is a manual process, while data stitching is automated
   • BAlert grouping is used for enrichment, while data stitching is used for reduction
   • CAlert grouping correlates data points, while data stitching aggregates alerts
   • DAlert grouping aggregates alerts, while data stitching correlates data points
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC manager notices that analysts are spending too much time triaging hundreds of similar alerts generated by a brute-force attack on a single server. The manager wants to reduce the time spent on triage while still capturing all relevant details. Which approach should the manager implement?

   • AUse data stitching to merge all brute-force alerts into a single alert.
   • BConfigure alert grouping to combine all brute-force alerts from the same server into a single incident.
   • CConfigure data stitching to link each brute-force alert to the server's patch history.
   • DDisable all brute-force alerts to eliminate the noise.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does data stitching enhance an investigation?

   • ABy reducing the number of false positives
   • BBy automatically blocking malicious IP addresses
   • CBy linking related data points to provide a complete picture of the event
   • DBy encrypting sensitive data in the data lake
   Reveal Solution Discussion Select an answer first