1.2 Explain Alert Prioritization Handling XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst wants to quickly see which alerts are starred for priority and also view the severity of each alert. The analyst wants to customize the alert list to display this information. What should the analyst do?

   • AConfigure featured fields to include the starred indicator and severity.
   • BUse incident domains to filter starred alerts.
   • CAdjust the incident scoring model to show starred alerts.
   • DCreate a new detection rule to generate a report.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How do incident domains assist in alert handling?

   • AThey encrypt the incident data for secure handling
   • BThey determine the exact remediation steps automatically
   • CThey replace the need for incident scoring
   • DThey enable analysts to apply domain-specific playbooks and workflows
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security operations center (SOC) uses XSIAM to triage alerts. The team notices that a large number of low-severity alerts from a single, noisy detection rule are consuming analyst time. The SOC manager wants to ensure that high-priority alerts are not buried under this noise. Which approach should the SOC take to improve alert prioritization?

   • ARe-categorize the noisy rule's alerts into a different incident domain.
   • BModify the incident scoring model to decrease the weight of the noisy rule's alerts.
   • CCreate a suppression rule to automatically close alerts from the noisy rule.
   • DAdjust the incident scoring model to increase the weight of the noisy rule's alerts.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does an analyst typically star an alert in XSIAM?

   • ABy selecting the alert and clicking the star icon in the alert list
   • BBy sending the alert to a third-party ticketing system
   • CBy creating a new incident from the alert
   • DBy editing the alert's severity field
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   An organization has separate teams for network security and endpoint security. They want to route alerts to the appropriate team based on the type of threat. Which feature should they use to categorize alerts for this purpose?

   • AIncident scoring
   • BAlert starring
   • CIncident domains
   • DFeatured fields
   Reveal Solution Discussion Select an answer first