Incident Handling And Response

An incident response team wants to customize the incident severity scoring in XSIAM to better reflect organizational risk. Where are incident risk scoring and severity mapping configurations managed?

An analyst needs to ensure that all incidents assigned to a specific threat group are automatically tagged with a custom label upon creation. Where can the analyst configure automatic tagging rules?

During an incident investigation in XSIAM, an analyst needs to determine the root cause of a suspicious process execution. The analyst has the process GUID and wants to see the full command line, parent process, and user context. Which XSIAM capability provides this information?

An analyst concludes an incident investigation and determines that the alert was a true positive, remediation actions have been completed, and no further steps are needed. What is the correct final state to assign to the incident in XSIAM?

An XSIAM analyst is investigating a phishing incident where a user clicked a malicious link and downloaded a payload. The analyst needs to determine the scope of the compromise by identifying all endpoints that communicated with the malicious domain. Which TWO XSIAM capabilities should the analyst use to efficiently identify affected endpoints? (Choose two.)

An XSIAM analyst is triaging a new high-severity incident. During investigation, the analyst determines that the activity is benign and wants to close the incident while ensuring that similar alerts are not re-triggered for this known-good activity. Which incident resolution action should the analyst take?

When configuring incident notification settings in XSIAM, which TWO notification channels are natively supported for alerting analysts about new high-severity incidents? (Choose two)

An XSIAM analyst is handling an incident where an endpoint has been confirmed infected with ransomware. The analyst has already collected the ransom note and process execution logs as evidence. According to standard incident response procedures within XSIAM, what is the next appropriate action to prevent further encryption and lateral movement?

When reviewing an incident in the XSIAM Incident View, which TWO pieces of high-level summary information are immediately visible to an analyst? (Choose two)

When managing the incident lifecycle in XSIAM, an analyst determines that a triggered alert is a false positive and wants to prevent similar alerts from generating incidents in the future. What is the recommended action?

An XSIAM analyst is investigating a suspected credential dumping attack (e.g., LSASS memory dumping). Which THREE types of evidence or indicators should the analyst look for in XSIAM endpoint telemetry? (Choose three)

An XSIAM analyst is reviewing an incident where a suspicious binary was executed on a critical server. The analyst wants to determine the parent process that spawned the binary and the full command line used. Which XSIAM artifact or view should the analyst consult?

An XSIAM analyst is investigating a malware incident where the endpoint has been isolated from the network. The analyst needs to retrieve a copy of a suspicious executable from the endpoint for further analysis in a sandbox. Which XSIAM capability should the analyst use to obtain the file?

An analyst is investigating an incident where a suspicious file was dropped on a host. To verify if other hosts across the enterprise have seen this exact file hash, which XSIAM search tool should the analyst use?

An XSIAM analyst is investigating a suspected data exfiltration incident. The analyst needs to identify all outbound connections from a specific endpoint to external IP addresses that transferred more than 100 MB of data in the last 24 hours. Which XQL query will achieve this?

An analyst is handling an incident in XSIAM where the same endpoint has generated three separate alerts for suspicious PowerShell activity over the past hour. The analyst wants to consolidate these related alerts into a single investigation view to avoid duplicate effort. Which XSIAM feature should the analyst use?

When reviewing an incident in XSIAM, an analyst sees multiple related alerts grouped together. What is the term used in XSIAM for an individual security detection that contributes to an incident?

An XSIAM analyst is reviewing a new high-severity incident and wants to see all the raw alerts, entities, and evidence that XSIAM automatically grouped together for this incident. Which part of the incident view should the analyst examine?

An analyst needs to assign an unassigned incident to a specific Tier 2 response engineer within the XSIAM incident management interface. Which field must the analyst modify?

An XSIAM analyst is reviewing an incident that was automatically created by the platform. The incident details show that it was triggered by a correlation rule. The analyst wants to understand exactly which raw log entries matched the rule's criteria. Where can the analyst find this information?

When reviewing security events in the XSIAM Incident View, an analyst notices that an event has a 'BIOC' tag. What does BIOC stand for in the context of XSIAM and Cortex XDR?

An XSIAM analyst is leading the response to a confirmed ransomware outbreak. The incident was created automatically by the platform. The analyst needs to locate all affected endpoints and initiate remote live terminal sessions to contain the threat. Which area of the XSIAM console should the analyst use?

Which TWO actions can an analyst perform when managing incidents collectively using bulk actions in the XSIAM Incident Management interface? (Choose two)

An XSIAM analyst is handling an incident that requires immediate containment of a malicious file hash across all endpoints. The analyst wants to automate this response for future similar incidents. Which XSIAM capability should the analyst use?

An incident responder is investigating a ransomware outbreak. Which THREE immediate containment or remediation actions can be executed directly from XSIAM to mitigate the threat? (Choose three)

An XSIAM analyst is responding to an incident involving a compromised endpoint. The analyst needs to isolate the endpoint from the network while preserving the ability to remotely investigate it. Which XSIAM action should the analyst perform?

An administrator is designing a data ingestion pipeline in XSIAM. Which THREE data source categories can be ingested and normalized into XSIAM for security analytics? (Choose three)

An analyst receives an incident in XSIAM and wants to quickly gather more context about a suspicious file hash without leaving the incident view. Which action should the analyst take?

An analyst is troubleshooting a correlation rule that is failing to trigger incidents despite matching raw logs. Where can the analyst test and debug the rule logic against historical or sample log data in XSIAM?

An XSIAM analyst is reviewing an incident that includes a 'Remote Process Execution' alert. To better understand the parent-child relationship and command-line arguments, the analyst opens the Causality View. Which feature in the Causality View allows the analyst to see the full command line and other process details for a specific process?

An analyst is performing forensics on a suspicious process execution in XSIAM. Which THREE artifacts or views are typically available in the Causality Analysis of an alert? (Choose three)

An XSIAM analyst is reviewing an incident and wants to see the chronological sequence of events that led to the alert. Which XSIAM feature provides a timeline view of the incident's related activities?

An XSIAM analyst is responding to an incident where an attacker moved laterally using remote service creation. The analyst wants to identify all endpoints where the attacker created a service with a specific suspicious binary path during the last 48 hours. Which approach best accomplishes this?

An XSIAM analyst is investigating a potential data exfiltration incident. The analyst wants to identify all endpoints that communicated with a specific suspicious external IP address (203.0.113.45) over the past 7 days. Which XQL query should the analyst use to retrieve this information from the network data?

An analyst is investigating an incident and needs to isolate an infected endpoint directly from the XSIAM Incident View. Which response action should the analyst execute?

A Cortex XSIAM analyst is investigating a ransomware incident. The analyst needs to isolate an infected endpoint from the network to prevent lateral movement. Which action should the analyst take within the XSIAM incident response console?

An XSIAM analyst is handling a critical ransomware incident. The analyst finishes containment, remediation, and verification, and wants to close the incident with the correct status so that reporting reflects a genuine security event that was resolved. Which incident status should the analyst select?

While reviewing a complex multi-stage attack in XSIAM, an analyst wants to visualize the sequence of process creation events on an endpoint. Which XSIAM feature provides a graphical representation of parent-child process relationships and associated network connections?

An XSIAM analyst is investigating an incident where a user's credentials were likely compromised. The analyst wants to gather evidence of potential credential misuse. Which TWO XSIAM data sources or views should the analyst examine? (Choose two.)

During an incident investigation in Cortex XSIAM, an analyst needs to determine the scope of a credential theft attack. The analyst wants to identify all endpoints where a specific compromised user account was used to log in successfully after the initial compromise. Which XQL query should the analyst run?

An analyst needs to share specific indicator of compromise (IOC) details discovered during an incident with an external ISAC. Which mechanism in XSIAM allows exporting or sharing threat indicators?

An XSIAM analyst is reviewing an incident where a user's credentials were used to access a sensitive server from an unusual geographic location. The analyst suspects the credentials were compromised. Which XSIAM feature should the analyst use to quickly determine if the user account has been involved in any other suspicious activities across the environment?

An XSIAM analyst is investigating an incident and wants to add a note documenting the containment steps taken, so that other responders and auditors can see the actions in the incident timeline. Where should the analyst record this information?

An analyst is examining an alert timeline in XSIAM. What does the timestamp on a security event represent?

When analyzing security events in XSIAM, what are THREE key benefits of data normalization? (Choose three)

An analyst is investigating an incident where an attacker attempted to clear Windows Event Logs to hide malicious activity. Which XSIAM behavioral detection category typically flags this suspicious administrative tampering?

Which TWO information sources or artifacts can an analyst inspect within an XSIAM incident to understand the scope of an attack? (Choose two)

An analyst is handling an incident in XSIAM where the attacker moved laterally from a compromised workstation to a server. The analyst wants to identify all affected endpoints and their current containment status from a single view. Which XSIAM feature should the analyst use?

During an investigation, an analyst identifies an external IP address communicating with multiple internal hosts. To gather threat intelligence context on this IP address directly within XSIAM, which feature should the analyst inspect?

An analyst is responding to an incident involving a compromised user account in XSIAM. The analyst needs to contain the threat and prevent further unauthorized access. Which TWO actions should the analyst take? (Choose two.)

A security analyst is handling a new incident in Cortex XSIAM. The incident contains a high-severity alert for 'Suspicious PowerShell Execution' on host FIN-PC-07. The analyst wants to quickly determine the parent process of the PowerShell instance to understand how it was launched. Which XSIAM feature should the analyst use?

An XSIAM analyst is responding to a confirmed malware incident on an endpoint. The analyst needs to immediately isolate the endpoint from the network to prevent further spread. Which XSIAM action should the analyst take?

An analyst needs to export a detailed report of all closed incidents over the last 30 days for an executive summary. Where can this report generation be initiated within XSIAM?

An XSIAM Analyst is reviewing the Incident Management dashboard and needs to understand why a specific high-severity incident was automatically merged with an existing one. Which XSIAM feature determines this grouping behavior?