2.5 Identify and Describe Incident Preprocessing and Postprocessing Functions XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which scenario is a typical use case for a preprocessing function in XSOAR?

   • ADeleting temporary files used during the investigation
   • BNormalizing incoming data to a standard format before incident creation
   • CSending a closure summary to a ticketing system
   • DUpdating an external SIEM with the incident status after closure
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An XSOAR administrator is designing a preprocessing rule that must both filter out known-bad test alerts and enrich remaining alerts with a reputation score from an external API. The API call can take up to 30 seconds, and the team wants to avoid slowing down incident creation. What is the best way to implement this?

   • AUse a preprocessing rule to filter, and let the enrichment happen in the playbook after incident creation.
   • BUse a single preprocessing rule that runs a script to filter and then call the API synchronously.
   • CUse a field mapping to filter and enrich during ingestion.
   • DUse a postprocessing rule to filter and enrich after closure.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations team receives thousands of raw email alerts daily from a legacy gateway. Many are duplicates of the same campaign, and the team wants to reduce noise before incidents are created. They also need to standardize the severity field so that 'high', 'High', and 'HIGH' all map to a single value. Which approach should they use?

   • ASet up a job that runs every hour to find and close duplicate incidents and update severity values.
   • BUse a field mapping in the integration instance to change the severity and remove duplicates during ingestion.
   • CConfigure a preprocessing rule that runs a script to deduplicate and normalize the severity field before incident creation.
   • DCreate a postprocessing rule that runs after incident closure to clean up duplicate incidents and update severity.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a typical postprocessing use case in XSOAR?

   • AFiltering out low-severity alerts before they become incidents
   • BAssigning a playbook to an incident based on its type
   • CSending a notification to a channel when an incident is closed
   • DAdding context to incident fields from external databases
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An XSOAR administrator needs to implement a preprocessing rule that runs a Python script to enrich incident fields with threat intelligence data before the incident is created. What is the correct way to implement this in XSOAR?

   • ACreate a postprocessing rule that invokes an automation script after incident closure.
   • BAdd the script as a task in the incident's playbook and let it run when the incident is created.
   • CUse the integration's field mapping to call the script during ingestion.
   • DCreate a preprocessing rule that invokes an automation script and configure it to run before incident creation.
   Reveal Solution Discussion Select an answer first