An organization wants to ensure that any analytic alert involving executive leadership endpoints automatically receives the maximum possible priority score in XSIAM, regardless of the default analytic score. How should an administrator achieve this?
Trap 1: Modify the correlation rule XQL code to hardcode severity based on…
Analytic alerts are out-of-the-box or managed via settings, not custom XQL correlation rules.
Trap 2: Update the Endpoint Security Policy to isolate executive machines…
Isolation is a containment action, not an alert prioritization method.
Trap 3: Build an automation playbook that modifies the incident severity…
Playbooks act post-incident creation, whereas prioritization happens at ingest/alert generation time.
- A
Modify the correlation rule XQL code to hardcode severity based on IP address ranges.
Why wrong: Analytic alerts are out-of-the-box or managed via settings, not custom XQL correlation rules.
- B
Configure a custom prioritization rule in XSIAM that targets assets with the 'Executive' tag and sets the priority override to High/Critical.
Custom prioritization rules support asset context and tags to override alert scoring.
- C
Update the Endpoint Security Policy to isolate executive machines upon any alert.
Why wrong: Isolation is a containment action, not an alert prioritization method.
- D
Build an automation playbook that modifies the incident severity immediately upon creation.
Why wrong: Playbooks act post-incident creation, whereas prioritization happens at ingest/alert generation time.