2.5 Identify and Describe Incident Preprocessing and Postprocessing Functions XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   After an incident is resolved and closed, the SOC wants to automatically send a summary to a Slack channel and update an external ticketing system with the resolution notes. They do not want this to happen while the incident is still being worked. Which XSOAR feature should they use?

   • AA field mapping that automatically sends Slack messages and updates the ticketing system when the incident is created.
   • BA postprocessing rule that triggers a playbook on incident closure to send Slack messages and update the ticketing system.
   • CA scheduled job that checks for closed incidents every 5 minutes and performs the notifications.
   • DA preprocessing rule that runs a script before incident creation to send the summary and update the ticketing system.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In XSOAR, how are preprocessing and postprocessing functions typically implemented?

   • AAs built-in playbook tasks that are added to every playbook
   • BAs layout widgets that run on page load
   • CAs scripts or automations that are referenced by pre-processing and post-processing rules
   • DAs custom incident fields that trigger actions when changed
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which scenario is a typical use case for a postprocessing function in XSOAR?

   • ANormalizing timestamp formats in incoming alerts
   • BEnriching incoming indicators with threat intelligence before incident creation
   • CDeduplicating incidents that have the same source IP
   • DCleaning up temporary resources created during the incident investigation
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a typical preprocessing use case in XSOAR?

   • AArchiving incident data to long-term storage after closure
   • BFiltering out irrelevant or duplicate incidents before they are created
   • CGenerating a post-incident report for management
   • DSending a notification to the SOC manager after incident closure
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of an incident postprocessing function in XSOAR?

   • ATo run actions after an incident is closed, such as cleanup or notification
   • BTo enrich incident data with threat intelligence during the investigation
   • CTo define the playbook that will run when an incident is created
   • DTo filter and deduplicate incoming incidents before they are created
   Reveal Solution Discussion Select an answer first