1.2 Explain Alert Prioritization Handling XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   An analyst is triaging a queue of alerts and identifies a critical alert that requires immediate attention. The analyst wants to ensure this alert is visually highlighted and easy to find for the next shift. Which action should the analyst take?

   • AStar the alert to mark it as important.
   • BChange the incident domain to a more critical category.
   • CManually increase the incident score.
   • DCreate a new detection rule to re-trigger the alert.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is triaging alerts and sees a high-scoring alert that appears to be a false positive based on prior experience. The analyst wants to ensure this alert is not repeatedly prioritized in the future. What should the analyst do?

   • AStar the alert to mark it as a false positive.
   • BIgnore the alert and hope it does not recur.
   • CChange the incident domain to 'False Positive'.
   • DAdjust the incident scoring model to reduce the score for similar alerts.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of incident scoring in XSIAM?

   • ATo assign a numerical priority to incidents based on their potential impact and urgency
   • BTo encrypt incident data for secure storage
   • CTo permanently delete low-priority incidents from the system
   • DTo automatically resolve incidents without analyst intervention
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following best describes how incident scoring is calculated in XSIAM?

   • AIt is derived from a combination of alert severity, confidence, and asset criticality
   • BIt is a static value assigned by the analyst when creating the incident
   • CIt is based solely on the number of alerts in the incident
   • DIt is determined by the age of the incident
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC is reviewing their incident scoring model and finds that alerts from a specific detection rule are consistently scored too high, leading to wasted effort on false positives. The rule is still valuable for detecting real threats, but the false positive rate is high. What should the SOC do to improve prioritization?

   • AIncrease the score for all other rules to make them stand out.
   • BDisable the rule to eliminate false positives.
   • CLower the score contribution for that rule in the scoring model.
   • DChange the incident domain for alerts from that rule.
   Reveal Solution Discussion Select an answer first