Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementMedium
A CISO requires a daily summary report of all 'High' and 'Critical' severity incidents that are currently 'Open' or 'In Progress', including their assigned owner and the time since creation. This report needs to be automatically generated and emailed to key stakeholders every morning. Which Cortex XSOAR capability should be configured to meet this reporting requirement?
- AScheduling a dashboard report with specific widgets and filters.
- BCreating a custom incident type for 'High/Critical' incidents.
- CManually exporting incident data from the incident list view daily.
- DImplementing a playbook that sends a War Room summary.
Show answer & explanationAnswer & explanation
Correct answer: A. Scheduling a dashboard report with specific widgets and filters.
Cortex XSOAR Dashboards with configured widgets can visualize the required data (severity, status, owner, time since creation). These dashboards can then be scheduled to generate reports (e.g., PDF) and automatically email them, fulfilling the CISO's request for an automated daily summary.
Why the other options are wrong
- B. Creating a new incident type categorizes, but doesn't generate or email reports.
- C. Manual export does not meet the 'automatically generated and emailed' requirement.
- D. A playbook could send a summary, but a War Room summary is often less structured and visual than a dashboard report, and dashboards are the dedicated reporting feature.
Cortex XSOAR Scheduled Reports
Cortex XSOAR allows users to schedule the automatic generation and distribution of reports, typically based on dashboard configurations. These reports provide regular updates on incident metrics, operational status, and compliance to relevant stakeholders.
- Based on existing dashboards and widgets.
- Can be scheduled daily, weekly, monthly.
- Support various formats (PDF, CSV).
- Automated email distribution to defined recipients.
Memory trick: Schedule a Dashboard, Deliver a Daily Report.