Certified XSIAM Analyst (XSIAM-Analyst) (XSIAM-Analyst) — Questions 301–327

The 'Isolate Endpoint' action in XSIAM, typically available through the response playbook or action center, immediately quarantines the endpoint by blocking network communication while maintaining management connectivity. This is the correct action to contain a malware incident and prevent lateral movement. It is a standard containment step in incident response.

In XSIAM, alerts are generated by analytics and then evaluated against incident grouping rules. Until an alert matches a rule that triggers incident creation, it remains standalone and does not appear in the Incidents view. The 'Under Investigation' status indicates an analyst is reviewing it, but it is still an alert, not an incident. This is the expected behavior when no grouping rule has been satisfied.

The ASM Findings table lists all discovered issues. Clicking a finding opens a detailed side panel that includes the service banner, risk description, and recommended remediation steps. This is the primary location for analysts to investigate and act on ASM findings, making it the correct answer.

The `alter` stage creates or replaces fields in the pipeline, and nesting conditional expressions lets the analyst assign tiered values in order. The first matching condition wins, so checking the smallest threshold first then the next threshold correctly buckets low, medium, and high while leaving all original fields intact.

Task output mapping writes selected fields from an upstream task into named context keys. Downstream tasks then reference those keys, which decouples the consumer from the exact shape of the raw API response and is the recommended pattern for passing structured data reliably.

The `bin` function rounds or truncates a timestamp into fixed-width buckets, so applying it to the time field within the grouping produces one row per source-destination pair per hour. This is the standard way to build time-series aggregations in XQL and directly supports beaconing analysis.

The Reporting module provides prebuilt and custom report templates, including incident-based reports scoped by status and time range. Selecting closed incidents over 30 days there generates the exportable executive summary the analyst needs, matching the stem's requirement.

Analytic alerts originate from XSIAM's built-in behavioural and machine-learning detection engines, requiring no authoring. XQL correlation alerts instead run user-written XQL queries against ingested data, so the analyst defines the logic. This satisfies the stem's distinction between vendor-supplied detections and custom query-based rules.

Incident Stitching applies correlation rules that group related alerts sharing entities, causality chains or temporal proximity into one incident. This explains why a high-severity incident merged automatically: the stitching engine matched its underlying alerts to an existing incident rather than creating a duplicate.

The dataset command names the source table or dataset that seeds the query pipeline, so every subsequent stage filters and transforms that data. Without it, XQL has no starting data source, satisfying the requirement to define where the query begins.

XSIAM correlates alerts sharing entities such as host, user or IP within a time window, stitching them into one unified incident. This grouping gives the analyst a single case containing both the suspicious process and outbound connection, preserving causal context instead of separate tickets.

ASM only discovers and scans assets within its configured seed domains and IP ranges. Newly acquired subsidiary ranges absent from that scope are never enumerated, so they cannot appear in the asset inventory regardless of scan health.

XSIAM automatically correlates alerts into incidents by evaluating shared entities such as the same host, user account, or IP address, along with temporal proximity. When multiple alerts reference overlapping indicators within a defined window, the correlation engine groups them into a single incident. This explains why three related alerts appear under one incident rather than as separate entries, matching the described behavior.

A conditional task in Cortex XSIAM evaluates one or more conditions and routes execution along a matching path. By combining severity equals Critical and IP classification equals External with a logical AND, the task proceeds only when both are true, which matches the requirement precisely and keeps the branching logic inside the playbook.

XQL Search queries the historical dataset directly, letting the analyst hunt the process hash or name across all endpoints for the past 30 days. This satisfies the enterprise-wide, 30-day retrospective scope that a single alert view cannot provide.

The XSIAM Endpoints page provides an action to enable a disabled agent. When an agent is disabled, either by an administrator or automatically due to a policy, selecting the endpoint and choosing 'Enable Agent' sends a command to the agent to resume normal operation and re-enable all protection features according to its assigned policy. This is the correct administrative action to restore protection.

A conditional task evaluates the output of the preceding 'Get Asset' task and routes execution based on whether the asset record exists. The default path handles the empty-result case by proceeding directly to notification, satisfying the requirement to skip enrichment while continuing the workflow.

This query first counts events per process name and event type. The second 'stats' command sums the counts conditionally: 'exec_count' for process events and 'net_count' for network events, grouped by process name. It then filters for processes with at least 5 executions. Finally, it calculates the ratio of network connections to executions. This precisely meets the requirement.

Cortex XSIAM playbook tasks expose a retry configuration where the analyst can specify how many times the task should be re-executed and how long to wait between attempts. Setting the retry count to 3 with a 5-second interval causes the task to re-run after a transient failure without manual intervention, which directly addresses the intermittent timeout described in the scenario.

Clicking the asset in the Attack Surface Management inventory opens its risk and finding details pane, which surfaces the certificate finding's context and remediation guidance. This directly satisfies the stem's requirement to view detailed finding context for the flagged external web server, since ASM consolidates per-asset findings there rather than in alert or endpoint views.

A sub-playbook packages reusable tasks into a modular component invoked by multiple parent playbooks, satisfying the stem's requirement for reuse across playbooks. It differs from task-level constructs by encapsulating a complete callable workflow with its own inputs and outputs.

Enabling 'Continue on error' allows the playbook to proceed even if the isolation task fails, and a later task can inspect the result to log or remediate the failure. This matches the requirement to keep the playbook running while capturing the failure for review. It is the standard XSIAM mechanism for non-blocking error handling within a playbook.

Seeding ASM with registered domain names and related organizational identifiers lets Cortex XSIAM expand discovery automatically, enumerating subdomains, related hosts, and external-facing services as the footprint grows. This delivers continuous discovery without per-host manual entry, which is exactly what the team needs when new subsidiaries are onboarded.

XSIAM allows administrators to define custom prioritization rules that adjust alert severity based on asset criticality, user role, or other metadata. If the affected asset has a high criticality tag, the rule could automatically elevate the severity. This is a common method to ensure important assets receive appropriate attention without manual intervention.

The Threat Intelligence module can perform enrichment lookups that query configured intelligence sources for a specific artifact, returning reputation and context even when the value is not yet in the local store. This lets the analyst investigate the domain in-platform rather than pivoting to external tools. It is the intended capability for on-demand checks during an active investigation of an unlisted indicator.

Analytics continuously parse ingested telemetry, applying detection logic to produce structured alerts. Those alerts then feed incident creation, so analytics form the evaluation layer between raw data and incidents, satisfying the requirement to describe their role in XSIAM's alerting pipeline.

XSIAM exports custom playbooks as ZIP archives holding Content Packs, or as standalone JSON, satisfying the cross-tenant portability requirement. The ZIP Content Pack bundles playbook definitions with their dependent objects, ensuring production imports resolve references cleanly rather than failing on missing components.