CCNA Incident Interactions And Reporting Questions

The War Room input box accepts free-text entries that become notes attributed to the analyst with a timestamp. Pressing Enter posts the remark to the shared conversation, making it visible to every team member reviewing the incident. No command execution is involved, which matches the requirement exactly.

Severity is a standard incident field with defined values, and widget queries support filtering or grouping on it, allowing dashboards to surface critical incidents. This meets the requirement for a categorisation attribute in custom widget queries.

The War Room search box filters the timeline by keyword, command name, or analyst, letting the analyst jump directly to the containment command entry. For a closed incident with hundreds of entries, this is the fastest way to locate the specific execution and its associated user and timestamp.

The Owner dropdown in the incident header lets an analyst assign the incident to themselves directly, satisfying the requirement to reassign from the incident view without navigating elsewhere. This updates ownership in place, reflecting the analyst as the responsible party.

Scheduled reports require recurrence settings (e.g., daily, weekly) to trigger automatically.

The Tags field on the incident Details tab is designed for free-form labels that analysts can add or remove. Saving the incident persists the tag, and other users can then search for it using the tags filter in the Incidents page. This directly enables the quick filtering and discovery the scenario requires.

The Indicators page supports exporting selected indicators, and STIX or CSV output contains only indicator data. This shares exactly the required indicators without notes or timeline entries. The partner can then import the STIX or CSV into their own Cortex XSOAR instance, satisfying both the content restriction and the interoperability requirement.

Setting the Owner field to the shift lead transfers incident ownership, triggers an in-app notification, and makes that user the acknowledged owner. This is precisely what is needed for an 8-hour handoff on a malware containment incident, ensuring the on-call lead is accountable during the shift.

Tabs are a core layout component, letting engineers group related incident fields, sections and widgets across separate views within the custom incident layout. This directly satisfies the stem's requirement to identify includable components, since Cortex XSOAR's layout editor exposes tabs as a configurable structural element alongside sections and fields.

The report content must be scoped to VIP-labeled incidents from the prior week, so an incident filter combining the VIP label and a rolling date range is required. Without this filter, the report would include unrelated incidents and fail the manager's content requirement.

Custom tabs group related incident fields into named sections such as Triage and Containment, so analysts navigate fewer screens and enter data faster. This directly satisfies the stem's workflow and data-entry efficiency constraint by restructuring the layout rather than altering underlying incident data.

Incident layout validation or closing rules enforce mandatory fields at closure, blocking the close action until closeReason is populated. This satisfies the requirement that closure reasons be mandatory whenever an incident is closed, without relying on analyst discipline.

A playbook task of type 'War Room entry' can run commands like !domain and use the returned context to build markdown. When the Phishing playbook triggers on incident creation, the task executes automatically and posts the result into the War Room without analyst intervention. This satisfies both the automatic execution and the per-incident sender domain reputation requirement.

A playbook can include a task that triggers when the incident is closed, such as a conditional task based on the incident status. This task can run a script or integration command to generate a summary report and attach it to the incident. This is the most flexible and standard way to automate post-closure actions in Cortex XSOAR.

Report templates let the engineer define exactly which sections and fields are rendered, so the output can include incident metadata, a playbook task summary, and closing notes while deliberately omitting raw command results. This gives precise control over the artifact's contents and readability. Combined with report generation from the incident, it satisfies the scenario's curation requirement.

Dashboard widgets execute their saved query on each render, so an overly broad time range or loose filter forces a large scan. Narrowing the range and tightening filter criteria reduces the data the query returns, cutting widget latency and dashboard lag.

A custom dashboard with a table widget allows filtering incidents by assignee and severity, providing a real-time view of open high/critical incidents assigned to the analyst. This is a built-in feature that requires no coding and can be shared or set as default, making it the most efficient solution for the requirement.

Each War Room entry has a context menu accessed via the three-dot icon, which includes 'Add Tag'. This applies a user-defined tag directly to that entry, enabling later filtering by tag. It is the intended mechanism for labeling individual entries in the incident's War Room timeline.

Dashboard widgets query underlying indices through the viewer's role, so missing permissions on those data sources cause load failures. Verifying the role's index and incident access directly addresses the authorisation constraint in the stem, rather than widget code or engine health.

The War Room is the incident's centralised collaboration and audit workspace, capturing analyst notes, executed commands and playbook task results in real time. It satisfies the requirement for a single chronological audit trail by recording every action against the incident as it happens, rather than scattering evidence across separate tools.

Report templates (often Word/DOCX based or HTML) can be uploaded and customized under the Reports section.

The WorkArea search bar accepts Lucene-style field queries, so 'owner:me and status:Investigation' filters incidents on both the owner and status fields simultaneously. This satisfies the analyst's need to isolate their own incidents currently in Investigation status, returning the precise subset directly rather than requiring manual sorting or separate filters.

Cortex XSOAR supports @-mentions in War Room entries. Typing @ and selecting the username notifies that user and links the mention to their account, which is the standard way to draw a teammate's attention within an incident.

A line chart is ideal for displaying trends over time, such as incident resolution times. It can plot metrics like average resolution time per day or week, allowing the administrator to identify patterns and anomalies. This widget type directly supports the requirement to monitor trends in incident resolution performance.

Analyst notes and comments are captured directly in the War Room, creating a shared, timestamped record that satisfies the requirement for collaborative investigation within the incident. This keeps discussion attached to the incident itself rather than external channels, so responders can review reasoning and evidence alongside the artefacts and tasks already surfaced there.

Dashboard widgets support queries that run against incident data, and a Pie chart can group results by a field such as severity. By scoping the query to open incidents from the current week, the widget shows the required breakdown and refreshes as incident data changes. This matches the grouping and automatic-update requirements.

The Work Plan tab renders the playbook as a structured task tree with each task's status, start and end times, and the inputs and outputs captured during execution. Reviewing it for a completed phishing incident lets the analyst confirm the exact order of automation steps and inspect what each task returned, which is precisely the step-by-step record being requested.

Reports are generated from Dashboards > Reports, where the analyst selects a report template and defines the timeframe. This location produces the PDF containing aggregated metrics such as incident closure rates for the last month, matching the stem's reporting requirement.

Incident Info section layout is governed by the incident type's layout configuration. Settings > Customization > Layouts lets the administrator assign custom fields to the section, and applying it to the phishing incident type makes those fields appear for all phishing incidents.

A Section of type Query pulls data from a saved War Room query and renders it as the chosen widget, which is exactly how dynamic War Room content is embedded. Other section types cannot execute saved queries.

The 'Tasks' view in the War Room filter dropdown restricts the timeline to playbook task-related entries, including task start, inputs, outputs, and completion status. This directly matches the responder's need to isolate task activity from command and note noise in a large phishing incident with 14 tasks and hundreds of entries.

Role-based sharing lets the administrator grant dashboard visibility only to selected Cortex XSOAR roles, satisfying controlled distribution. Permissions follow the role assignment, so users in those roles see the dashboard without exposing it to the entire tenant.

Typing plain keywords into the Incident WorkArea search bar performs a free-text match across indexed incident fields such as name and details. This unstructured querying satisfies the stem's requirement for a filtering method, complementing field-scoped syntax by locating incidents when the exact field is unknown.

The auto-refresh dropdown in the dashboard header directly controls the polling interval at which widgets re-query their data sources, satisfying the 60-second automatic update requirement without editing individual widget queries or the underlying dashboard definition.

Selecting Bar as the chart type and grouping by the incident field that stores the source brand produces the required per-brand incident counts. The grouping field supplies the categorical axis, while the bar chart renders each brand's tally as a separate bar.

Playbooks trigger through the incident type's configured association, so a missing or incorrect playbook link on that type prevents automatic execution at creation. Confirming the association ensures the incident type actually maps to the intended playbook.

Generating a custom Incident Report satisfies the audit's requirement for War Room notes and playbook history, since the Reports feature can be configured to include those specific sections. Unlike raw API exports or manual copying, it consolidates incident details into a single auditable document suitable for external compliance review.

Dashboard sharing is governed by Roles, so restricting visibility to Tier-2 requires editing the dashboard's Sharing settings and assigning only that role. This scopes access at the dashboard level rather than through incident types or user groups.

In Cortex XSOAR, right-clicking on a field value in the incident details pane often provides a context menu with options to search for incidents with the same value. This allows the analyst to quickly pivot to related incidents without manually typing a query, directly satisfying the requirement for a quick search based on the Malware Family field.

Active is a native Cortex XSOAR incident status denoting an incident currently under investigation and owned by an analyst. It satisfies the question's requirement for a valid status, forming part of the platform's fixed lifecycle set rather than a custom field value.

Excel (XLSX) export produces a workbook of incident data directly from the Incident WorkArea, which is natively supported for external reporting and archival, satisfying the requirement for a structured spreadsheet format that analysts can filter and pivot without additional conversion.

The search bar applies a server-side query across all incident types simultaneously, filtering by owner and status fields. This satisfies the requirement to locate the user's own 'In Progress' incidents across multiple types in one pass, rather than manually filtering each type separately.

Adjusting section layout dimensions, orientation and page breaks directly controls how widgets are positioned and paginated within the generated PDF, resolving the overlapping charts and truncated text. These layout settings govern the report's physical rendering, which is the exact formatting constraint described in the stem.

Storing reports in the built-in repository satisfies the secure distribution requirement without external exposure, since access is governed by XSOAR role-based permissions. The reporting engine natively retains generated reports there for later download, making it one of the three supported delivery methods alongside email and integrations.

The War Room conversation records every entry, including automation command executions and their outputs. Applying the Commands and Results filter narrows the view to those technical entries in chronological order, exposing both the command text and the raw JSON returned by each integration. This directly matches the analyst's need for a single chronological technical view.

The Pie widget renders categorical incident data as proportional slices, directly grouping incidents by severity into a circular chart. Selecting Pie during widget creation satisfies the requirement to visualise severity distribution as a pie chart.

Custom fields must first exist in the Fields repository before they can be placed on any layout. Creating 'BusinessUnit' as a Short text field defines its data type and makes it available to layouts. Without this step, the field cannot be added to the incident layout, so this is a required prerequisite for the scenario.

Closing incidents is offered in the Incident WorkArea action menu, letting analysts resolve multiple selected incidents in one operation. This satisfies the stem's requirement that the action be performed directly from that menu rather than by opening each incident record individually.

The ${incident.id} path resolves dynamically to the unique identifier of the incident in which the script executes. Referencing it in the War Room lets the script act on the current incident without hard-coding an ID.

Closure layouts can define which fields appear when closing an incident, and fields can be marked required. By configuring the closure layout so Close Notes is mandatory for the False Positive classification, the platform enforces the note before the incident can be closed.

Dashboard sharing in Cortex XSOAR is controlled from the share icon, which opens a dialog listing users and roles. Selecting the Tier2-SOC role restricts visibility to members holding that role, satisfying the requirement for role-scoped access.

The War Room text box supports Markdown formatting, including table syntax. By typing the note with Markdown table syntax, the analyst can create a formatted table that renders nicely in the War Room. This is the standard way to add rich-text notes directly without external tools.

Line charts are natively supported when building custom dashboard widgets in Cortex XSOAR, letting engineers plot time-series trends such as incident volume or severity over a selected period. This makes Line one of the three correct widget types in the scenario.

Dashboards are composed primarily of widgets displaying metrics and charts.

The incident ID appears in the header by default, giving engineers a unique reference for correlating the incident across the console, API calls and audit logs. It satisfies the stem's requirement for default header content, unlike custom fields or playbook outputs, which must be added manually.

Auto-extract indicator settings are defined per incident type, letting you control which indicator types Cortex XSOAR extracts from incident fields automatically. This satisfies the stem's requirement for associated configurations, alongside the other two correct options, by binding extraction behaviour directly to the custom incident type rather than globally.

Layouts can be assigned to specific incident types, ensuring tailored fields and tabs appear for specific incident categories.

Scheduled report definitions in Cortex XSOAR include a schedule field expressed in cron syntax that governs when the report is generated and dispatched. Setting it to fire every Monday at 08:00 is exactly what produces the recurring weekly delivery. Recipient addresses and output format are separate fields, so only the schedule setting determines recurrence, making it the element that must be configured for the Monday cadence.

Incident fields render in the Incident Info panel only when included in the incident type's layout. Creating a field registers it in the schema but does not place it on any layout, so analysts see nothing until it is added to the assigned layout.

A playbook attached to the Phishing incident type runs automatically when the incident is created. Adding a task that executes the addWarRoomEntry automation posts the runbook link into the War Room immediately, satisfying the requirement without analyst action. This is the standard pattern for seeding context into an incident's conversation at creation time.

Layout sections can be configured to render expanded or collapsed by default. Marking the section expanded ensures the department, manager, and compliance tier fields are immediately visible when the Data Breach incident opens, without the analyst having to click to reveal them.

The Incoming Mapper attached to the integration instance defines how raw fetched data maps to incident fields. Editing that mapper lets the administrator hard-code SourceChannel to 'Email' for every incident created by this instance, satisfying the automatic population requirement.