XSOAR-Engineer Incident Interactions And Reporting — 20 Questions

Question 1

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

Accepted Answer

Dashboards > Reports. Reports are managed and generated from the Dashboards & Reports section in XSOAR.

Answer

Incidents > Export > Report

Answer

Threat Intel > Indicators > Export

Answer

Settings > Advanced > Reports

Question 2

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

Accepted Answer

Settings > Customization > Layouts. Layouts in XSOAR define the visual presentation of incident details based on incident types.

Answer

Settings > About > Server Configuration

Answer

Settings > Integrations > Instances

Answer

Incidents > War Room > Layout Configuration

Question 3

An analyst is reviewing the War Room audit log and notices that an entry generated by an integration script contains sensitive API keys. How can the analyst remove this sensitive text from the War Room history?

Accepted Answer

Hover over the specific War Room entry, click the options menu, and select 'Delete'. War Room entries can be deleted or edited depending on user permissions and entry types, or masked if configured, but individual entries can be deleted by authorized users.

Answer

Modify the integration code to retroactively scrub historical database entries

Answer

Lock the incident, which automatically sanitizes all War Room text matching regex patterns

Answer

Run the '!clear-war-room-secrets' command with the entry ID

Question 4

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

Accepted Answer

Pie. Pie chart widgets are used to show distribution ratios across categories like severity.

Answer

Bar

Answer

Number

Answer

Line

Question 5

During a high-severity incident, an analyst needs to run a playbook task manually while bypassing standard automated conditional gates. How can this be accomplished from the War Room?

Accepted Answer

Navigate to the Playbook tab within the incident, select the specific task, and choose 'Force Run'. Analysts can use the 'task' or similar War Room CLI capabilities or interact with the Playbook tab directly to force execution, but forcing task execution via the Playbook view or CLI override allows manual intervention.

Answer

Restart the entire XSOAR server container to reset playbook state machines

Answer

Type '!force-playbook-task' directly in the War Room CLI without parameters

Answer

Edit the incident type schema to automatically convert all conditional tasks to automatic

Question 6

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

Accepted Answer

Generate a custom Incident Report using the Reports feature configured to include War Room and playbook sections. Incidents can be exported or packaged, and full audit trails can be exported via reports or incident export features.

Answer

Use the standard CSV export from the Incident WorkArea

Answer

Take screenshots of every tab in the incident view manually

Answer

Query the Elasticsearch database directly using raw SQL queries

Question 7

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

Accepted Answer

Configure a custom incident layout associated with the 'Malware' incident type that includes the desired widget/section. Dashboards can be filtered, and incident-specific widgets or layout tabs can be customized by incident type layouts.

Answer

Configure an integration instance to push UI updates to the active browser session

Answer

Write a custom automation script that opens a browser popup window whenever Malware is detected

Answer

Modify the global server.properties file to inject widgets into all incident screens

Question 8

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

Accepted Answer

Use the WorkArea search bar with the query 'owner:me and status:Investigation'. Filtering incidents in the WorkArea using query builder or pre-filtered views allows analysts to isolate specific criteria such as owner and status.

Answer

Export all incidents to CSV and filter them locally in Microsoft Excel

Answer

Navigate to Settings > Integrations and configure a new filter rule for active incidents

Answer

Create a new custom dashboard widget every time a personal filter is needed

Question 9

Where can an analyst view a chronological timeline of all automated and manual actions taken within an active incident?

Accepted Answer

The War Room tab. The War Room maintains the complete chronological audit trail of actions, commands, and outputs.

Answer

The Threat Intel tab

Answer

Settings > About

Question 10

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

Accepted Answer

Edit the widget definition to narrow its time range and optimize the query filter criteria. Widget queries use XSOAR query language and time ranges; refining the query scope and time range improves performance.

Answer

Disable the Elasticsearch index lifecycle management policy entirely

Answer

Convert the widget from a chart type to a number type without changing the query

Answer

Increase the browser cache size in the client workstation registry

Question 11

An analyst needs to add a private note to an incident's War Room that only specific team members can view. How should the analyst enter the note?

Accepted Answer

Type the text directly into the War Room input bar and press Enter. War Room notes can be prefixed or tagged, but standard War Room entries are visible to all users with access to the incident. (Note: XSOAR War Room entries are generally visible to all incident viewers unless using specific role permissions, but standard entry is typed directly into the CLI/input box). Let's frame around standard entry.

Answer

Use the '!private-note' automation command

Answer

Export the incident to an encrypted ZIP file

Answer

Navigate to Settings > Security > War Room Encryption

Question 12

An administrator wants to create a dashboard widget that counts only incidents where the SLA has been breached. Which query syntax should be used in the widget definition?

Accepted Answer

slastatus:breached. SLA status is tracked via built-in fields like 'duedate' or specific SLA indicator flags such as 'closingReason' or SLA breach properties.

Answer

status:closed and severity:high

Answer

duedate > now

Answer

sla:expired

Question 13

An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?

Accepted Answer

The Owner dropdown field in the incident header. The Owner field in the incident header or layout allows quick assignment to users.

Answer

The Close Incident button

Answer

The Playbook graph zoom button

Answer

The War Room attachment paperclip icon

Question 14

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?

Accepted Answer

In the integration instance configuration under Incoming Mapper. Integration instance mapper configurations handle mapping incoming raw data fields to XSOAR incident fields.

Answer

In the global Layouts customization menu

Answer

Inside the server.properties configuration file

Answer

Within the War Room CLI using the '!set-field' command

Question 15

An enterprise requires that all incident reports generated and emailed by XSOAR include custom branding headers and footers. Where is this template customized?

Accepted Answer

Dashboards & Reports > Reports > Template management. Report templates in XSOAR use docx or HTML/PDF templates managed under Dashboards & Reports > Reports settings or template customization.

Answer

Settings > Integrations > Email Server > Templates

Answer

Settings > Customization > Branding & Logos

Answer

The incident layout editor under Settings > Customization > Layouts

Question 16

An administrator is troubleshooting a scheduled report that fails to email its PDF output to stakeholders. Where should the administrator check first to diagnose the delivery failure?

Accepted Answer

Settings > About > Troubleshooting > Server Logs. Server logs and the specific reporting execution logs help identify mailing or rendering errors.

Answer

The Incident War Room of the report creator

Answer

The browser developer tools console while viewing the dashboard

Answer

Settings > Integrations > Instances > Mail Sender status

Question 17

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

Accepted Answer

${incident.id}. XSOAR automation contexts use incident metadata paths such as ${incident.id}.

Answer

${playbook.case_id}

Answer

${active.incident_number}

Answer

${demisto.current_id}

Question 18

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Accepted Answer

Click the share icon on the dashboard and select the 'Tier2-SOC' role. Dashboards can be shared with specific roles or users via dashboard sharing settings.

Answer

Assign the 'Tier2-SOC' role inside the global server.properties configuration

Answer

Place the dashboard JSON file into the specific role's local file directory on the server

Answer

Configure Active Directory group mapping rules in the integration settings

Question 19

An enterprise requires that incident closure reasons must be mandatory whenever an incident is closed. How can an administrator enforce this requirement?

Accepted Answer

Configure incident layout validation rules or closing rules requiring the 'closeReason' field. Closing rules or layout validation rules can require specific fields upon closure.

Answer

Enable 'Strict Mode' under Settings > Integrations

Answer

Delete the default close button and require analysts to use CLI commands exclusively

Answer

Modify the server license file to enable strict closure enforcement

Question 20

An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?

Accepted Answer

The auto-refresh dropdown menu located in the dashboard header. Dashboard refresh intervals can be configured via the dashboard view controls.

Answer

Settings > Customization > UI Preferences

Answer

Dashboards > Widget Editor > Refresh Interval

Answer

Settings > Server Configuration > Dashboard.Refresh.Rate