1.2 Explain Alert Prioritization Handling XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–22

1. 21expert · hard

   A SOC manager is reviewing the incident scoring model and notices that alerts from a specific rule are consistently scored too low, causing them to be ignored. The rule detects a new type of threat that is not yet well understood. The manager wants to ensure these alerts are not missed. What should the manager do?

   • AIncrease the score contribution for that rule in the scoring model.
   • BDisable the rule to avoid false positives.
   • CStar all alerts from that rule.
   • DChange the incident domain for alerts from that rule.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is an incident domain in XSIAM?

   • AA user-defined label for tracking ownership
   • BA storage location for incident data
   • CA network segment where the incident occurred
   • DA category that classifies incidents based on the type of threat or activity
   Reveal Solution Discussion Select an answer first