Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementMedium
A SOC manager is reviewing the metrics for incident response efficiency. They notice that 'Malware Infection' incidents consistently have a long 'Time to Containment'. To understand the bottleneck, they want to generate a report that specifically shows the average duration of each task within the 'Malware Containment' sub-playbook for all 'Malware Infection' incidents over the last month. Which Cortex XSOAR feature combination would best facilitate this reporting requirement?
- AIncident Layouts and Custom Incident Fields
- BWar Room and Incident Notes
- CThreat Intelligence Management and Feeds
- DDashboards and Widgets with Playbook Task Metrics
Show answer & explanationAnswer & explanation
Correct answer: D. Dashboards and Widgets with Playbook Task Metrics
Dashboards with specialized widgets are designed to visualize metrics. Cortex XSOAR can track the duration of playbook tasks, and these metrics can be displayed on dashboards to identify bottlenecks and inefficiencies in workflows.
Why the other options are wrong
- A. Incident layouts and custom fields are for data display and storage, not for reporting task duration metrics.
- B. War Room and incident notes primarily document the investigation process, not aggregate task timing metrics.
- C. Threat intelligence management focuses on IoC feeds, not incident response task timing.
Cortex XSOAR Playbook Task Metrics
Cortex XSOAR tracks the execution duration and status of individual tasks within playbooks, providing valuable metrics for performance analysis and optimization.
- Automatically collected by XSOAR.
- Can be visualized in dashboards.
- Helps identify bottlenecks in automation workflows.
Memory trick: To see the 'dash' of performance, you need a 'dashboard' and 'widgets'.