4.1 Explain Incident States and Actions XSOAR-ENGINEER Practice Questions (Page 5)

Questions 21–21

1. 21application · medium

   An XSOAR incident is currently in the 'In Progress' state. An analyst realizes the incident was created by mistake and should not have been opened. The analyst wants to remove it from the active queue without performing any further investigation. What is the most appropriate action?

   • AClose the incident with a reason of 'False Positive'.
   • BChange the incident state to 'New'.
   • CReopen the incident to reset its state.
   • DAssign the incident to a different owner and leave it in progress.
   Reveal Solution Discussion Select an answer first