2.1 Explain the Incident Creation Process XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC receives a high volume of alerts from a new detection rule. Many alerts are false positives, but some are genuine. The team wants to reduce noise while ensuring that genuine alerts are not missed. What should the SOC do in XSIAM?

   • ADisable the detection rule to stop all alerts.
   • BIncrease the severity of all alerts from this rule to ensure attention.
   • CTune the detection rule and use grouping rules to consolidate related alerts into fewer incidents.
   • DCreate a playbook that automatically closes all alerts from this rule.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which combination of factors is used to assign priority to an incident in XSIAM?

   • AImpact and urgency
   • BSource IP and destination port
   • CUser role and department
   • DAlert count and time of day
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A critical incident is created and automatically assigned to the incident response team. The team investigates and determines that the incident is a false positive. According to the incident lifecycle, what should the team do next?

   • AClose the incident with a classification of 'False Positive' and document the reason.
   • BEscalate the incident to a higher-tier team for further investigation.
   • CLeave the incident open for a period of time to monitor for any signs of activity.
   • DContain the incident by isolating the affected endpoint.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the first step in the incident creation workflow in XSIAM?

   • AThe incident is closed
   • BAn alert is generated from a detection or manual report
   • CThe incident is enriched with threat intelligence
   • DThe incident is assigned to an analyst
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An incident is created from a single alert about a suspicious PowerShell command. The analyst wants the incident to include the user's identity, the device's risk score, and any related alerts from the past 24 hours. What should the analyst rely on in XSIAM to populate these fields?

   • AIncident data enrichment that pulls context from identity, device, and alert sources.
   • BThe incident closure report that summarizes the investigation.
   • CManual entry of all context into the incident notes.
   • DThe alert's raw log only, which contains all necessary context.
   Reveal Solution Discussion Select an answer first