Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementMedium
A security analyst needs to quickly understand the current status, assigned owner, and pending tasks for all active phishing incidents. They also want to track the average time it takes to close phishing incidents over the last month. Which combination of Cortex XSOAR features would provide this information most efficiently?
- ACustom incident fields and incident layouts.
- BIncident correlation rules and War Room entries.
- CDashboards with specific widgets and incident reporting.
- DPlaybook tasks and automation scripts.
Show answer & explanationAnswer & explanation
Correct answer: C. Dashboards with specific widgets and incident reporting.
Dashboards with widgets provide real-time visual summaries of incident status, ownership, and pending tasks. Incident reporting allows for historical analysis of metrics like average closure time, making this the most efficient combination.
Why the other options are wrong
- A. Custom fields store data, and layouts display it, but they don't aggregate or analyze metrics across multiple incidents.
- B. Correlation rules group incidents, and War Room logs collaboration, neither directly provides aggregated status/metrics efficiently.
- D. Playbook tasks and automation scripts *perform* actions, they don't provide aggregate reporting or historical analysis.
XSOAR Dashboards & Reporting
Cortex XSOAR Dashboards provide real-time visual summaries of incident data and operational status using configurable widgets, while reporting features enable export and scheduled delivery of historical trends and metrics.
- Crucial for operational awareness and performance monitoring.
- Customizable for different roles (analyst, manager, executive).
- Supports both current status and historical trend analysis.
Memory trick: Dashboard shows all, from status to historical call.