XSOAR-Engineer Incident Interactions And Reporting — Timed 10 Questions

Question 1

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

Accepted Answer

Dashboards > Reports. Reports are managed and generated from the Dashboards & Reports section in XSOAR.

Answer

Incidents > Export > Report

Answer

Threat Intel > Indicators > Export

Answer

Settings > Advanced > Reports

Question 2

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

Accepted Answer

Settings > Customization > Layouts. Layouts in XSOAR define the visual presentation of incident details based on incident types.

Answer

Settings > About > Server Configuration

Answer

Settings > Integrations > Instances

Answer

Incidents > War Room > Layout Configuration

Question 3

An analyst is reviewing the War Room audit log and notices that an entry generated by an integration script contains sensitive API keys. How can the analyst remove this sensitive text from the War Room history?

Accepted Answer

Hover over the specific War Room entry, click the options menu, and select 'Delete'. War Room entries can be deleted or edited depending on user permissions and entry types, or masked if configured, but individual entries can be deleted by authorized users.

Answer

Modify the integration code to retroactively scrub historical database entries

Answer

Lock the incident, which automatically sanitizes all War Room text matching regex patterns

Answer

Run the '!clear-war-room-secrets' command with the entry ID

Question 4

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

Accepted Answer

Pie. Pie chart widgets are used to show distribution ratios across categories like severity.

Answer

Bar

Answer

Number

Answer

Line

Question 5

During a high-severity incident, an analyst needs to run a playbook task manually while bypassing standard automated conditional gates. How can this be accomplished from the War Room?

Accepted Answer

Navigate to the Playbook tab within the incident, select the specific task, and choose 'Force Run'. Analysts can use the 'task' or similar War Room CLI capabilities or interact with the Playbook tab directly to force execution, but forcing task execution via the Playbook view or CLI override allows manual intervention.

Answer

Restart the entire XSOAR server container to reset playbook state machines

Answer

Type '!force-playbook-task' directly in the War Room CLI without parameters

Answer

Edit the incident type schema to automatically convert all conditional tasks to automatic

Question 6

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

Accepted Answer

Generate a custom Incident Report using the Reports feature configured to include War Room and playbook sections. Incidents can be exported or packaged, and full audit trails can be exported via reports or incident export features.

Answer

Use the standard CSV export from the Incident WorkArea

Answer

Take screenshots of every tab in the incident view manually

Answer

Query the Elasticsearch database directly using raw SQL queries

Question 7

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

Accepted Answer

Configure a custom incident layout associated with the 'Malware' incident type that includes the desired widget/section. Dashboards can be filtered, and incident-specific widgets or layout tabs can be customized by incident type layouts.

Answer

Configure an integration instance to push UI updates to the active browser session

Answer

Write a custom automation script that opens a browser popup window whenever Malware is detected

Answer

Modify the global server.properties file to inject widgets into all incident screens

Question 8

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

Accepted Answer

Use the WorkArea search bar with the query 'owner:me and status:Investigation'. Filtering incidents in the WorkArea using query builder or pre-filtered views allows analysts to isolate specific criteria such as owner and status.

Answer

Export all incidents to CSV and filter them locally in Microsoft Excel

Answer

Navigate to Settings > Integrations and configure a new filter rule for active incidents

Answer

Create a new custom dashboard widget every time a personal filter is needed

Question 9

Where can an analyst view a chronological timeline of all automated and manual actions taken within an active incident?

Accepted Answer

The War Room tab. The War Room maintains the complete chronological audit trail of actions, commands, and outputs.

Answer

The Threat Intel tab

Answer

Settings > About

Question 10

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

Accepted Answer

Edit the widget definition to narrow its time range and optimize the query filter criteria. Widget queries use XSOAR query language and time ranges; refining the query scope and time range improves performance.

Answer

Disable the Elasticsearch index lifecycle management policy entirely

Answer

Convert the widget from a chart type to a number type without changing the query

Answer

Increase the browser cache size in the client workstation registry