3.4 Manage Incident and Alert Layout XSIAM-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst wants to add a custom field called 'Business Impact' to the incident layout so that it appears in a new section. The field already exists in the incident data model. What is the correct sequence of actions?

   • AEdit the incident layout, add a new section, drag the 'Business Impact' field into it, and save the layout.
   • BUse the layout version history to add the field to a previous version.
   • CCreate a new incident type, add the field to that type, and assign it to the layout.
   • DModify the alert layout to include the field, then save the alert layout.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company uses XSIAM to manage both network alerts and endpoint alerts. The SOC wants the network alert layout to show source/destination IPs prominently, while the endpoint alert layout should show process and file details. They have created two custom alert layouts. What is the correct way to ensure each alert type uses its respective layout?

   • AAssign the network layout to the network alert type and the endpoint layout to the endpoint alert type.
   • BAssign the layouts to incident types instead of alert types.
   • CCreate a single combined layout that includes both IPs and process details for all alerts.
   • DApply the network layout to all alerts and manually switch to endpoint layout for endpoint alerts.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An administrator has edited the incident layout to add a new 'MITRE ATT&CK' section. After saving, they open an existing incident that was created before the change, but the new section is not visible. What is the most likely reason?

   • AThe administrator edited the alert layout instead of the incident layout.
   • BThe layout was not saved correctly; the administrator needs to save again.
   • CExisting incidents may not automatically reflect layout changes; the layout applies to new incidents.
   • DThe incident type does not support custom layouts.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An XSIAM administrator recently modified the incident layout to add a new 'Threat Intel' section. After saving, analysts report that the layout is confusing and they prefer the previous version. The administrator wants to revert to the last known good configuration without manually undoing each change. What should the administrator do?

   • AUse the layout version history to restore the previous version.
   • BEdit the layout again to remove the new section and reorder fields back.
   • CDelete the current layout and recreate it from scratch.
   • DCreate a new incident type and assign the old layout to it.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which statement best describes the scope of incident layout management in XSIAM?

   • AIt manages the underlying data model of incidents
   • BIt defines the structure and arrangement of fields and sections in the incident detail view
   • CIt configures the email notifications sent when an incident is created
   • DIt applies only to the incident list view, not the detail view
   Reveal Solution Discussion Select an answer first