2.5 Identify and Describe Incident Preprocessing and Postprocessing Functions XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–17

1. 16application · medium

   A SOC closes phishing incidents after confirming the user did not click the link. They want to automatically release any quarantined email from the user's mailbox after closure, but only if the incident was closed as 'False Positive'. Which XSOAR mechanism should they use?

   • AA manual task in the playbook that analysts must remember to run after closing.
   • BA preprocessing rule that releases the quarantined email before incident creation.
   • CA postprocessing rule that runs a playbook on closure, checking the close reason and releasing the quarantined email if it is 'False Positive'.
   • DA field mapping that automatically releases the quarantined email when the incident is created.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which XSOAR feature is used to run a preprocessing function on incoming incidents?

   • APre-processing rules
   • BLayouts
   • CPost-processing rules
   • DIncident fields
   Reveal Solution Discussion Select an answer first