Incident Interactions And Reporting

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?

An enterprise requires that all incident reports generated and emailed by XSOAR include custom branding headers and footers. Where is this template customized?

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

An enterprise requires that incident closure reasons must be mandatory whenever an incident is closed. How can an administrator enforce this requirement?

An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?

An administrator is troubleshooting an issue where custom incident fields created in XSOAR are not appearing when analysts attempt to edit them in the Incident Info panel. What is the most likely root cause?

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

Which TWO pieces of information are displayed prominently in the incident header by default?

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

Which TWO methods can an administrator use to share a dashboard with other users in Cortex XSOAR?

Which TWO actions can an analyst perform within the Incident War Room?

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

An XSOAR administrator needs to restrict visibility of a specific incident dashboard so that only members of the Tier-2 SOC team can view it. Where should the administrator configure this permission?

A security analyst wants to build a custom incident report that automatically includes a dynamic widget generated from a saved query in the War Room. Which report element type must the analyst use to incorporate this War Room data?

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

An XSOAR report is scheduled to run weekly, but the output PDF contains overlapping widget charts and truncated text blocks. Which setting should the administrator adjust within the Report configuration to fix the formatting?

A user needs to quickly locate all incidents assigned to them that are currently in 'In Progress' status across multiple different incident types. What is the most efficient way to achieve this using the Incident List view?

An analyst wants to create a custom dashboard widget that displays a bar chart of incidents grouped by their source brand (e.g., CrowdStrike, SentinelOne). Which widget configuration property should the analyst select?

An administrator is configuring scheduled reports in Cortex XSOAR and needs to distribute the final reports securely. Which THREE distribution or delivery methods are natively supported by the XSOAR reporting engine?

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

An XSOAR administrator is troubleshooting why a custom dashboard widget is failing to load and returning an error. Which TWO potential causes should the administrator investigate?

An analyst is working a phishing incident in Cortex XSOAR and wants to tag a War Room entry with a custom classification label so the entry can be filtered later. Where should the analyst apply this tag?

An analyst needs to mention a specific teammate in a War Room entry so that teammate receives a notification about the incident. Which syntax should the analyst use when composing the entry?

A security team wants every incident closed with a 'False Positive' classification to require a mandatory closing note explaining the rationale. Which Cortex XSOAR feature should be configured to enforce this?

An incident responder is viewing an active phishing incident in the Cortex XSOAR Incident WorkArea. The incident has 14 tasks, but the War Room is cluttered with hundreds of automated entries. The responder wants to see only the task-related activity (task inputs, outputs, and status changes) without the noise from commands and notes. Which War Room view should the responder select?

A security analyst is working a malware containment incident and needs to hand it off to the on-call shift lead for the next 8 hours. The analyst wants the shift lead to receive an in-app notification and become the acknowledged owner of the incident. Which action should the analyst take in the Incident WorkArea?

A Cortex XSOAR administrator is preparing a recurring incident summary for the SOC manager. The manager wants a scheduled delivery that arrives every Monday at 07:00 local time and includes only incidents tagged with the 'VIP' label from the previous week. The administrator plans to use a scheduled report with a filter and must configure the delivery and content options correctly. Which two configurations are required to meet these requirements? (Choose two.)

A SOC manager needs every new 'Phishing' incident to automatically include a link to the corporate phishing triage runbook in the incident's War Room, without analysts manually pasting it. Which Cortex XSOAR feature should the engineer configure to achieve this at incident creation time?

A Cortex XSOAR analyst is reviewing a closed ransomware incident from three months ago and needs to verify which analyst executed a specific containment command and at what time. The War Room contains hundreds of entries, and the analyst wants the fastest way to find that specific command execution rather than scrolling the timeline. Which approach should the analyst use?

An administrator is configuring a new Cortex XSOAR dashboard to monitor incident response performance. The dashboard should display metrics that help identify trends in incident resolution times and analyst workload. Which TWO widget types should the administrator use to effectively visualize these metrics? (Choose two.)

An analyst investigating a live incident wants to see every command that was executed by the playbook, along with the raw JSON results returned by each integration, in a single chronological view inside the incident. Which War Room capability should the analyst use?

A Cortex XSOAR engineer is configuring an incident layout so that when an analyst opens a 'Data Breach' incident, the layout automatically surfaces the affected user's department, manager, and compliance tier from a custom incident field group. The engineer wants the layout to display these fields prominently without requiring the analyst to expand a collapsed section. Which layout configuration should the engineer apply?

An engineer is preparing a post-incident review and must give stakeholders a concise, shareable artifact that summarizes the incident's key fields, the playbook tasks that ran, and the analyst's closing notes, without exposing raw integration JSON. Which TWO Cortex XSOAR capabilities should the engineer use to produce this artifact? (Choose two.)

A junior analyst responds to an incident and wants to leave a timestamped remark visible to the whole team that explains why a suspicious file was marked benign, without executing any command. Which action in the incident War Room accomplishes this?

A SOC manager wants every new 'Phishing' incident to automatically display a custom War Room entry containing the sender's domain reputation and a link to VirusTotal. The information must appear without any analyst action. What should the manager configure in Cortex XSOAR?

A Cortex XSOAR administrator needs to ensure that a specific custom incident field named 'BusinessUnit' is visible and editable in the incident layout for the 'Malware' incident type only. Which TWO configuration steps are required? (Choose two.)

An analyst is working on an incident in Cortex XSOAR and needs to quickly find all incidents that share the same 'Malware Family' custom field value as the current incident. Which feature should the analyst use?

An analyst is investigating a live incident and needs to share a set of indicators with an external partner without exposing internal notes or the full incident timeline. The analyst must produce a file that the partner can import into their own Cortex XSOAR instance. What should the analyst do?

An administrator wants to ensure that when an incident is closed in Cortex XSOAR, a summary report is automatically generated and attached to the incident as a text file. Which feature should the administrator configure to achieve this?

During an active incident, an analyst wants to tag the incident with a custom label 'VIP-Customer' so that other team members can quickly filter and find it later. Where should the analyst add this label in Cortex XSOAR?

An analyst is reviewing a high-severity incident and wants to add a note to the War Room that includes a table of indicators extracted from the incident. The analyst wants the note to be easily readable and formatted. Which method should the analyst use to add the note?

A Cortex XSOAR administrator is building a custom dashboard widget that must show the number of open incidents grouped by severity for the current week, updating automatically as incidents change. Which widget configuration should the administrator use?

An analyst is reviewing a closed phishing incident and wants to see, in the War Room, which playbook tasks executed and in what order, including the inputs and outputs of each task. Which War Room tab should the analyst use to review this structured, step-by-step record of the playbook run?

A Cortex XSOAR engineer needs a recurring report that delivers a PDF summarizing incident metrics to an external distribution list every Monday at 08:00. The engineer creates a scheduled report and must now ensure the recipient addresses, format, and recurrence are all honored. Which configuration element in the scheduled report definition controls the recurring schedule?

A Cortex XSOAR administrator wants to provide analysts with a quick way to view all open incidents that are assigned to them and have a severity of 'High' or 'Critical'. Which built-in feature should the administrator configure?