1.2 Explain Alert Prioritization Handling XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of starring an alert in XSIAM?

   • ATo mark it as a false positive
   • BTo flag it for special attention and prioritize it in the queue
   • CTo delete it from the incident list
   • DTo automatically escalate it to a higher tier
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   An analyst is working through a queue of alerts and wants to temporarily mark a set of alerts for follow-up after handling more urgent ones. The analyst does not want to change the incident score or domain. What should the analyst do?

   • ACreate a new detection rule to re-trigger the alerts.
   • BManually adjust the incident score.
   • CStar the alerts to mark them for follow-up.
   • DChange the incident domain to 'Follow-up'.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization has a compliance requirement to report on all alerts related to insider threats. They want to ensure these alerts are easily identifiable in the queue and that the relevant information is displayed. What should they do?

   • ACreate a new detection rule for insider threats.
   • BUse incident domains to categorize insider threat alerts and configure featured fields to show relevant details.
   • CAdjust the incident scoring model to prioritize insider threat alerts.
   • DStar all insider threat alerts.
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   An analyst is triaging a queue and sees an alert that requires immediate attention but is not yet starred. The analyst wants to ensure the alert is prominently displayed for the next shift. What should the analyst do?

   • ACreate a new detection rule.
   • BAdjust the incident score.
   • CChange the incident domain.
   • DStar the alert.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC manager wants to improve the efficiency of the triage process by ensuring that alerts involving critical assets are always displayed prominently. The manager has already configured featured fields to show asset criticality. What additional configuration should the manager consider to further improve prioritization?

   • AAdjust the incident scoring model to increase scores for alerts involving critical assets.
   • BChange the incident domain for critical asset alerts.
   • CCreate a new detection rule specifically for critical assets.
   • DStar all alerts involving critical assets.
   Reveal Solution Discussion Select an answer first