3.4 Manage Incident and Alert Layout XSIAM-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   After modifying an incident layout in XSIAM, what must you do for the changes to take effect on live incidents?

   • ARecreate all existing incidents
   • BRestart the XSIAM service
   • CSave and apply the layout configuration
   • DWait for the next scheduled maintenance window
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An organization uses XSIAM to handle both incidents and alerts. They have a requirement that high-severity alerts should display a 'Critical Indicators' section, while low-severity alerts should not. They have created two alert layouts: one with the section and one without. What is the most efficient way to ensure the correct layout is used based on severity?

   • AAssign the 'Critical Indicators' layout to the alert type that high-severity alerts use, and the other layout to the alert type for low-severity alerts.
   • BUse a single alert layout and conditionally show the section based on severity using a script.
   • CCreate a new alert type for high-severity alerts and assign the layout to it, leaving the default for low-severity.
   • DAssign the layouts to incident types instead of alert types.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's SOC handles two incident types: 'Malware' and 'Phishing'. The team wants the Malware incident layout to show file hashes and sandbox results, while the Phishing layout should show email headers and URL reputation. They have created two custom layouts. What must be done to ensure each incident type displays the correct layout?

   • AAssign the Malware layout to the Malware incident type and the Phishing layout to the Phishing incident type.
   • BApply the Malware layout to all incidents and then manually switch to Phishing layout for phishing incidents.
   • CRename the incident types to match the layout names so they automatically align.
   • DCreate a single combined layout that includes both file hashes and email headers for all incidents.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst notices that alert details in XSIAM are cluttered with many fields, making it hard to focus on key indicators. The team wants to simplify the alert layout to show only the most relevant fields for triage. They have identified the fields to keep. What should they do to apply this change to all new alerts of a specific alert type?

   • ACreate a new incident type and assign the simplified alert layout to it.
   • BEdit the incident layout for that alert type, remove fields, and save.
   • CEdit the alert layout for that alert type, remove unnecessary fields, and save the layout.
   • DUse the layout version history to revert to a simpler previous version.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An organization has multiple incident types, and they want to use a single custom layout for all of them. However, they also want to ensure that any new incident type created in the future automatically uses this custom layout. What is the most efficient way to achieve this?

   • AAssign the custom layout to each existing incident type and also set it as the default layout for new incident types.
   • BModify the default layout to match the custom layout, and it will apply to all incident types.
   • CUse alert layouts instead of incident layouts to achieve consistency.
   • DCreate a new incident type and assign the custom layout to it, then use that type for all incidents.
   Reveal Solution Discussion Select an answer first