2.7 Differentiate Between Alert Grouping and Data Stitching XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security operations center (SOC) analyst sees 15 separate alerts for the same phishing email campaign hitting multiple users. Each alert contains the sender address, subject line, and the user's mailbox. The analyst wants to reduce the number of tickets and get a single view of the campaign. Which action best describes what the analyst should do?

   • AUse data stitching to merge the sender address and subject line into a single alert field.
   • BApply data stitching to link each alert to the user's Active Directory account and endpoint logs.
   • CUse alert grouping to link the alerts to external threat intelligence feeds.
   • DApply alert grouping to consolidate the 15 related alerts into a single incident.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is investigating a potential insider threat. The analyst has a VPN login log, a file server access log, and an email exfiltration alert. The analyst wants to determine if these events are related to the same user and time period. Which technique should the analyst use?

   • AData stitching to link the VPN login, file server access, and email exfiltration into a single user activity timeline.
   • BData stitching to merge the VPN log and file server log into a single log entry.
   • CAlert grouping to combine the VPN log, file server log, and email alert into one incident.
   • DAlert grouping to reduce the number of alerts generated by the VPN and file server.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC team is implementing a new incident management process. The team wants to ensure that analysts can quickly triage incidents and also have deep context for investigations. The team has limited resources and must choose a single primary approach. Which approach best balances triage efficiency and investigation depth?

   • AImplement data stitching as the primary approach, as it provides deep context for investigations.
   • BImplement alert grouping for triage and data stitching for investigations, using them in sequence.
   • CImplement a custom approach that uses alert grouping only for high-severity alerts and data stitching for all other alerts.
   • DImplement alert grouping as the primary approach, as it reduces the number of incidents and provides a high-level view.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which problem does alert grouping directly address?

   • ADifficulty in integrating with third-party tools
   • BAnalysts being overwhelmed by a high volume of alerts
   • CLack of context about a user's activities
   • DInability to detect zero-day attacks
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC analyst is investigating a series of alerts: 5 alerts for the same malware on a single host, and a separate set of logs showing the malware's communication with a C2 server, the user's login history, and the host's process execution. The analyst wants to create a single incident that minimizes noise and provides a complete attack narrative. The analyst has limited time and must choose the most efficient approach. Which approach should the analyst take?

   • AStitch the 5 malware alerts into one incident, then group the C2 logs, login history, and process execution into that incident.
   • BGroup the 5 malware alerts into one incident, then stitch the C2 logs, login history, and process execution to that incident.
   • CGroup all 5 malware alerts and the C2 logs, login history, and process execution into a single incident without stitching.
   • DStitch the C2 logs, login history, and process execution into a single data set, then group the 5 malware alerts into that data set.
   Reveal Solution Discussion Select an answer first