Incident Interactions And Reporting

An administrator configured a custom incident field of type 'MultiSelect', but analysts complain that they cannot select more than one option when creating a new incident. What is the most likely cause?

Which TWO built-in fields are automatically populated when a new incident is created in Cortex XSOAR?

Which THREE attributes can be used to filter or categorize incidents when building a custom dashboard widget query?

An analyst wants to assign an unassigned incident to themselves directly from the incident view. Which button or field should they interact with?

When configuring a scheduled report in Cortex XSOAR, which TWO parameters or options must be specified?

Which THREE components can be included when designing a custom incident layout in Cortex XSOAR?

When customizing incident layouts in Cortex XSOAR, which TWO components can an administrator configure to improve analyst workflow and data entry efficiency?

An enterprise requires that incident closure reasons must be mandatory whenever an incident is closed. How can an administrator enforce this requirement?

An analyst notices that a custom dashboard widget is loading very slowly, causing the entire dashboard render to lag. How can the administrator optimize this specific widget's query performance?

An XSOAR administrator is troubleshooting why a custom dashboard widget is failing to load and returning an error. Which TWO potential causes should the administrator investigate?

An analyst is reviewing an active incident in Cortex XSOAR and needs to document real-time notes, command executions, and playbook actions in a centralized audit trail. Which XSOAR feature should the analyst use?

Where can an analyst view a chronological timeline of all automated and manual actions taken within an active incident?

An enterprise requires that all incident reports generated and emailed by XSOAR include custom branding headers and footers. Where is this template customized?

An administrator is troubleshooting a scheduled report that fails to email its PDF output to stakeholders. Where should the administrator check first to diagnose the delivery failure?

An analyst wants to quickly find all incidents assigned to them that are currently in 'Investigation' status. Which method should be used from the Incident WorkArea?

An analyst wants to view incidents that were closed within the last 24 hours. Which query should be entered in the WorkArea search bar?

Which TWO actions can an analyst perform within the Incident War Room?

An analyst wants to generate a PDF report containing high-level metrics about incident closure rates over the last month. Where should the analyst initiate this report generation?

An administrator needs to modify the default layout of the Incident Info section so that custom fields appear prominently for all phishing incidents. Where should this be configured?

An administrator wants to ensure that specific sensitive incidents are restricted so that only members of the 'IncidentResponse' team can view or edit them. How should this be implemented?

A security analyst wants to build a custom incident report that automatically includes a dynamic widget generated from a saved query in the War Room. Which report element type must the analyst use to incorporate this War Room data?

During a high-severity incident, an analyst needs to run a playbook task manually while bypassing standard automated conditional gates. How can this be accomplished from the War Room?

Which TWO methods can an administrator use to share a dashboard with other users in Cortex XSOAR?

Which TWO methods can analysts use to filter incidents in the Incident WorkArea search bar?

An administrator wants to change the refresh rate of an active dashboard so that widgets update automatically every 60 seconds. Where is this setting adjusted?

An analyst wants to create a custom dashboard widget that displays a bar chart of incidents grouped by their source brand (e.g., CrowdStrike, SentinelOne). Which widget configuration property should the analyst select?

When troubleshooting an issue where an incident fails to trigger a playbook upon creation, which THREE areas should an administrator investigate?

An analyst needs to export all incident details, including War Room notes and playbook history, for an external compliance audit. What is the recommended approach?

An XSOAR administrator needs to restrict visibility of a specific incident dashboard so that only members of the Tier-2 SOC team can view it. Where should the administrator configure this permission?

Which TWO of the following options are valid incident statuses in Cortex XSOAR?

When exporting incident data for external reporting or archival purposes, which THREE formats are natively supported for data export from the Incident WorkArea?

A user needs to quickly locate all incidents assigned to them that are currently in 'In Progress' status across multiple different incident types. What is the most efficient way to achieve this using the Incident List view?

An XSOAR report is scheduled to run weekly, but the output PDF contains overlapping widget charts and truncated text blocks. Which setting should the administrator adjust within the Report configuration to fix the formatting?

An administrator is configuring scheduled reports in Cortex XSOAR and needs to distribute the final reports securely. Which THREE distribution or delivery methods are natively supported by the XSOAR reporting engine?

An analyst is reviewing the War Room audit log and notices that an entry generated by an integration script contains sensitive API keys. How can the analyst remove this sensitive text from the War Room history?

An administrator wants to create a new widget that displays a pie chart of incidents grouped by severity. Which widget type should be selected during creation?

Which THREE actions can be performed directly from the Incident WorkArea action menu for selected incidents?

An analyst running a script in the War Room needs to reference the ID of the current incident dynamically. Which built-id context path represents the current incident ID?

An analyst wants to create a custom dashboard that is visible only to members of the 'Tier2-SOC' role. How can this dashboard sharing be configured?

Which THREE of the following chart or widget types are natively available when creating custom dashboard widgets in Cortex XSOAR?

An analyst needs to add a private note to an incident's War Room that only specific team members can view. How should the analyst enter the note?

Which TWO elements are typically displayed on a standard Cortex XSOAR dashboard?

An administrator wants to create a dashboard widget that counts only incidents where the SLA has been breached. Which query syntax should be used in the widget definition?

Which TWO pieces of information are displayed prominently in the incident header by default?

When an administrator configures a custom incident type, which THREE associated configurations can be defined for that incident type?

An organization requires that any incident categorized as 'Malware' must automatically display a custom widget tracking containment progress in the incident summary. How should an administrator achieve this?

An administrator is troubleshooting an issue where custom incident fields created in XSOAR are not appearing when analysts attempt to edit them in the Incident Info panel. What is the most likely root cause?

An administrator wants to ensure that specific incident fields are automatically populated and marked as read-only once an incident reaches the 'Containment' phase. Where should this behavior be configured?

An administrator wants to ensure that all incidents created from a specific email integration instance automatically populate a custom field named 'SourceChannel' with the value 'Email'. Where is this mapping configured?