Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementEasy
A security analyst is investigating a complex incident involving multiple alerts from different sources that appear to be related to the same attack campaign. They want to consolidate all relevant information into a single incident to streamline investigation and avoid duplicate efforts. Which Cortex XSOAR feature allows combining multiple existing incidents into one primary incident?
- AIncident Linking
- BIncident Grouping
- CIncident Merging
- DIncident Correlation
Show answer & explanationAnswer & explanation
Correct answer: C. Incident Merging
Incident merging is the specific feature in Cortex XSOAR designed to combine multiple existing incidents into a single, comprehensive incident, transferring all relevant data to the primary incident.
Why the other options are wrong
- A. Incident linking creates a reference between incidents but keeps them separate.
- B. Incident grouping is a general term, but 'merging' is the specific XSOAR function for consolidation.
- D. Incident correlation identifies relationships between incidents but doesn't combine them into one.
Cortex XSOAR Incident Merging
Incident merging allows analysts to combine several related incidents into a single primary incident, consolidating all data, notes, and artifacts for a unified investigation.
- Consolidates data from multiple incidents.
- Reduces duplicate effort in investigations.
- One incident becomes the primary, others are merged into it.
Memory trick: When incidents are too many, you 'merge' them into one.