A SOC manager is concerned about the number of 'False Positive' alerts being escalated to Tier 2 analysts. They want to implement a mechanism in Cortex XSOAR that automatically closes incidents if they are identified as 'False Positive' within the first 15 minutes of creation, without requiring manual intervention. Which component is essential for achieving this rapid, conditional incident closure?
- AA dashboard widget displaying 'False Positive' rates.
- BA custom incident layout with a 'False Positive' button.
- CA playbook triggered by incident creation with a timer and conditional task.
- DIncident Correlation rule with a 'Close' action.
Show answer & explanationAnswer & explanation
Correct answer: C. A playbook triggered by incident creation with a timer and conditional task.
A playbook is the ideal component for this scenario. It can be triggered upon incident creation, include a timer to check the 15-minute window, and then use conditional logic to automatically close the incident if the 'False Positive' field is set, without requiring manual intervention.
Why the other options are wrong
- A. Dashboards are for reporting and visualization, not for automating incident response actions.
- B. A button on a layout requires manual interaction, which contradicts the 'without manual intervention' requirement.
- D. Correlation rules link incidents, they don't typically include timed, conditional closure logic.
Playbook Timers and Conditional Logic
Cortex XSOAR Playbooks can incorporate timers to wait for a specified duration or until a condition is met. Combined with conditional logic, this allows for time-sensitive, automated actions like escalating an incident if not addressed within a SLA, or closing it if an early condition is met.
- Enables time-based automation.
- Supports 'Wait for' tasks.
- Crucial for enforcing SLAs or rapid triage.
- Integrates with conditional branching for dynamic workflows.
Memory trick: Playbooks Play with Time, for automated crime-stopping rhyme.