Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementMedium
A security analyst is investigating a highly complex incident that spans multiple systems and involves several related alerts from different sources. To effectively manage this, they need to consolidate all relevant information under a single, unified view in Cortex XSOAR, ensuring that all associated alerts, artifacts, and investigation notes are easily accessible. Which feature is best suited for achieving this consolidated view?
- AExporting all related data to an external SIEM.
- BUsing incident layouts to display more fields.
- CCreating a new incident type for complex cases.
- DMerging multiple incidents into a single master incident.
Show answer & explanationAnswer & explanation
Correct answer: D. Merging multiple incidents into a single master incident.
Merging multiple related incidents into a single 'master' incident is the most effective way in Cortex XSOAR to consolidate all associated alerts, artifacts, and investigation notes into a unified view for complex, multi-faceted investigations.
Why the other options are wrong
- A. Exporting data to an external SIEM moves data out of XSOAR, rather than consolidating it within XSOAR for active investigation.
- B. Incident layouts customize the display of fields, but don't merge the underlying data from separate incidents.
- C. Creating a new incident type categorizes incidents, but doesn't consolidate existing ones.
Cortex XSOAR Incident Merging
Incident merging in Cortex XSOAR allows analysts to combine multiple related incidents (child incidents) into a primary 'master' incident. This consolidates all alerts, artifacts, tasks, and notes, streamlining the investigation of complex, interconnected security events.
- Consolidates related events under one master incident.
- Transfers alerts, artifacts, and notes to the master.
- Child incidents are usually closed or linked.
- Improves visibility and reduces duplicate effort.
Memory trick: Merge to Master, One View for the Cluster.