2.3 Demonstrate Understanding of Classifier and Mapper Configuration XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   A team is setting up a new integration that sends alerts with a field 'host' that contains the hostname and a field 'ip' that contains the IP address. The team wants the XSOAR incident fields 'hostname' and 'src' to be populated. What should the mapper configuration do?

   • AMap 'host' to 'src' and 'ip' to 'hostname'.
   • BMap both 'host' and 'ip' to 'hostname'.
   • CMap both 'host' and 'ip' to 'src'.
   • DMap 'host' to 'hostname' and 'ip' to 'src'.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security operations center (SOC) receives alerts from a cloud access security broker (CASB) and a data loss prevention (DLP) tool. The CASB sends alerts with a field 'risk_score' (integer), and the DLP sends alerts with a field 'severity' (string: 'low', 'medium', 'high'). The SOC wants all alerts to be classified as 'Data Security Incident' and to have the 'severity' field populated with a standardized value ('low', 'medium', 'high'). The team wants to minimize the number of components. What is the best approach?

   • ACreate two classifiers (both returning 'Data Security Incident') and two mappers, with the CASB mapper converting 'risk_score' to a severity string.
   • BCreate one classifier (returning 'Data Security Incident') and one mapper that handles both sources.
   • CCreate two classifiers and one mapper, with the mapper using a transformation to handle both sources.
   • DCreate one classifier and two mappers, and assign the mappers to the respective integrations.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization uses a custom SIEM that sends incident data to XSOAR. The SIEM's JSON payload includes a nested object 'source' with fields 'ip' and 'hostname'. The team needs these nested values to appear in the standard XSOAR incident fields 'src' and 'sourceHostname'. What is the most efficient way to achieve this?

   • AModify the SIEM to flatten the JSON so all fields are at the top level.
   • BUse a playbook to manually set the fields after the incident is created.
   • CConfigure a mapper with transformation rules that extract 'source.ip' and 'source.hostname' into the target fields.
   • DCreate a custom incident type with fields named 'source.ip' and 'source.hostname'.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A team is migrating from a legacy system to XSOAR. In the legacy system, incident data was stored in a flat structure. The new source sends data with nested objects. The team has configured a mapper to extract nested values, but some fields are still not being populated. Upon investigation, they find that the source sometimes sends the nested object as a JSON string and sometimes as an actual object. What should the mapper configuration do to handle this inconsistency?

   • AModify the source system to always send the nested object as a JSON string.
   • BUse a playbook to normalize the data after ingestion.
   • CUse a transformation that first checks if the field is a string and parses it if necessary, then extracts the nested value.
   • DConfigure two separate mappers, one for each data type, and assign them based on the source.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In XSOAR, after a classifier assigns an incident type, what is the next step in the incident handling process?

   • AThe associated layout is used to display the incident
   • BThe mapper is no longer needed
   • CThe incident is sent to the archive
   • DThe incident is automatically closed
   Reveal Solution Discussion Select an answer first