Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementMedium
A security analyst is investigating an incident where a user's credentials were compromised. During the investigation, they discover that the same user account has triggered similar alerts across three different systems (endpoint, email, and identity provider) within a 24-hour window. The analyst wants these three separate alerts, currently individual incidents, to be consolidated into a single, comprehensive incident for easier tracking and remediation. Which XSOAR capability would achieve this consolidation?
- AIncident merging
- BManual incident tagging
- CPlaybook sub-incidents
- DWar Room task assignment
Show answer & explanationAnswer & explanation
Correct answer: A. Incident merging
Incident merging in Cortex XSOAR allows multiple individual incidents to be combined into a single, master incident, inheriting data from the merged incidents and providing a unified view for investigation.
Why the other options are wrong
- B. Tagging adds metadata but doesn't consolidate separate incidents into one.
- C. Sub-incidents are typically created *from* a parent incident to manage distinct phases or related tasks, not to consolidate existing separate incidents.
- D. War Room task assignment is for managing activities within a single or existing incident, not for combining multiple incidents.
Cortex XSOAR Incident Merging
Incident merging in Cortex XSOAR is the process of combining two or more existing incidents into a single, master incident, typically when they are discovered to be related parts of a larger event.
- Consolidates related events for a unified investigation view.
- The 'master' incident inherits data and context from merged incidents.
- Reduces duplicate efforts and improves overall incident tracking.
Memory trick: Merge to make one, not just tag and run.