2.2 Configure Automation and Feed Integrations (e.g., Messaging, SIEM, Authentication, Threat Intelligence Feeds) XSIAM-ENGINEER Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security operations team wants to automatically notify the on-call analyst in a Slack channel whenever a high-severity incident is created in XSIAM. They have already created a Slack app and obtained a bot token. What should they configure in XSIAM to send the notification?

   • AConfigure an email integration and set up a distribution list for the on-call analyst.
   • BSet up a webhook in Slack and use it as a threat intelligence feed in XSIAM.
   • CCreate a Slack messaging integration and add a notification action to the incident creation playbook.
   • DCreate a SIEM integration to forward the incident data to Slack.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common method used to ingest events from an external SIEM into XSIAM?

   • AManually copying log files to the XSIAM server
   • BUsing a shared network drive to drop files
   • CUsing a syslog or API-based collector
   • DEstablishing a direct database link to the SIEM's storage
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat intelligence feed is configured with a schedule to update every hour. However, the feed data is not being refreshed. The feed URL is accessible and the API key is valid. What should the administrator investigate next?

   • ACheck the feed's parsing configuration to ensure the data format is correctly interpreted.
   • BEnsure that the feed is linked to a SIEM integration.
   • CConfirm that the feed is also configured as an email integration.
   • DVerify that the feed is being used in a playbook.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company wants to receive email alerts from XSIAM when a specific type of incident is created. They have configured an email integration, but no emails are being received. What should they verify first?

   • ACheck that the email integration is correctly configured with the SMTP server and authentication details.
   • BVerify that the incident type is being ingested from a SIEM integration.
   • CConfirm that the email integration is linked to an LDAP authentication source.
   • DEnsure that the email integration is also configured as a threat intelligence feed.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of automation integrations in XSIAM?

   • ATo replace the need for manual security analysis entirely
   • BTo provide a graphical user interface for configuring firewall rules
   • CTo store large volumes of security logs for compliance purposes
   • DTo connect XSIAM with external systems so that security operations can be automated and streamlined
   Reveal Solution Discussion Select an answer first