4.3 Explain Incident Relationships XSOAR-ENGINEER Practice Questions (Page 5)

Questions 21–21

1. 21application · medium

   A security team uses a custom playbook that automatically creates a child incident for each affected endpoint when a malware outbreak incident is detected. After a recent outbreak, the team notices that the child incidents were created, but they do not appear linked to the parent outbreak incident in the incident timeline. The playbook uses the 'Create New Incident' automation task. What should the team configure in the playbook task to ensure the child incidents are properly associated with the parent?

   • ASet the 'linkTo' field in the task to the parent incident ID
   • BAdd a 'Set Incident' task after creation to set the 'parent' field on the child incident
   • CUse the 'Create New Incident' task with the 'type' set to 'child'
   • DConfigure the 'Create New Incident' task to use the 'owner' field of the parent
   Reveal Solution Discussion Select an answer first