2.5 Identify and Describe Incident Preprocessing and Postprocessing Functions XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company ingests alerts from multiple sources that use different naming conventions for the same malware family (e.g., 'Emotet', 'EMOTET', 'emotet'). Analysts want all incidents to display a single standardized name so that searches and reports are consistent. Which preprocessing approach best achieves this?

   • AUse a preprocessing rule that runs a script to normalize the incident name field before creation.
   • BUse a postprocessing rule that renames incidents after they are closed.
   • CConfigure the integration to only ingest alerts that already use the standard naming convention.
   • DCreate a dashboard that displays a transformed name field for reporting purposes.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization wants to prevent incidents from being created for alerts coming from a specific test IP range. They also want to tag any incident that is created from a different internal range with a 'VIP' tag for priority handling. Which XSOAR feature should they use?

   • AA field mapping that filters out the test IP range and adds the 'VIP' tag.
   • BA playbook task that filters and tags incidents after they are created.
   • CA postprocessing rule that filters out the test IP range and adds the 'VIP' tag after closure.
   • DA preprocessing rule that filters out the test IP range and adds the 'VIP' tag to incidents from the internal range.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Where in the XSOAR UI would you configure a postprocessing function for incidents?

   • AIn the Automation section under Jobs
   • BIn the Playbooks section under Incident Response
   • CIn the Layouts section under Incident Types
   • DIn the Settings page under Post-processing rules
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In XSOAR, when does a postprocessing function typically run?

   • AWhen a user manually triggers it from the incident page
   • BAfter an incident is closed
   • CAt regular intervals during incident handling
   • DBefore an incident is created
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In XSOAR, what is the primary purpose of an incident preprocessing function?

   • ATo define the layout and fields displayed on the incident details page
   • BTo schedule recurring tasks that run at specified intervals during incident handling
   • CTo run automated actions after an incident is closed, such as sending a summary report
   • DTo execute a script or automation before an incident is created or handled, potentially modifying or filtering the incoming data
   Reveal Solution Discussion Select an answer first