Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementEasy
A security operations center (SOC) team uses Cortex XSOAR to manage a high volume of security alerts. They want to ensure that every new incoming alert from their SIEM is automatically categorized, assigned a severity, and routed to the correct analyst team based on its content (e.g., malware alert, phishing attempt, unauthorized access). Which Cortex XSOAR component is primarily responsible for performing these initial automated actions upon incident creation?
- AIncident types
- BIncident fields
- CDashboards
- DIncident layouts
Show answer & explanationAnswer & explanation
Correct answer: A. Incident types
Incident types in Cortex XSOAR define the structure, fields, playbooks, and automation rules that apply to specific categories of incidents, enabling automatic categorization and initial processing.
Why the other options are wrong
- B. Incident fields store specific pieces of information, but they don't dictate the automation or categorization process themselves.
- C. Dashboards provide reporting and visualization, not automation for incident creation and categorization.
- D. Incident layouts define the visual presentation of an incident's data, not its automation logic.
Cortex XSOAR Incident Types
Incident types in Cortex XSOAR classify and categorize security incidents, dictating their structure, associated playbooks, automation rules, and default field values.
- Each incident belongs to a specific type.
- Drives initial automation and playbook execution.
- Customizable to fit organizational incident response processes.
Memory trick: Type determines the playbook's plight.