Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementHard
A global organization uses Cortex XSOAR to manage incidents, with different teams responsible for different stages of the incident lifecycle. They need to ensure that once an incident moves from the 'Investigation' stage to the 'Containment' stage, only the 'Containment Team' can modify specific containment-related fields, and other teams can only view them. How can this be effectively implemented in Cortex XSOAR?
- ABy setting incident field permissions based on incident type.
- BBy creating separate incident types for each stage of the lifecycle.
- CBy using field-level permissions and conditional access based on incident stage and user roles.
- DBy configuring incident layouts to hide fields for certain roles.
Show answer & explanationAnswer & explanation
Correct answer: C. By using field-level permissions and conditional access based on incident stage and user roles.
Cortex XSOAR allows for granular field-level permissions, which can be dynamically applied based on conditions such as the incident's current stage or the user's role. This ensures that only authorized users can modify specific fields at relevant stages.
Why the other options are wrong
- A. Permissions based on incident type are static and don't change with incident stage.
- B. Creating separate incident types for each stage is impractical and doesn't manage field permissions within a single incident.
- D. Hiding fields prevents all modification, not just by specific teams, and doesn't allow for view-only access for others.
Cortex XSOAR Field-Level Permissions
Cortex XSOAR allows administrators to define granular read/write permissions for individual incident fields, which can be conditional based on factors like incident type, status, stage, or user roles.
- Granular control over data access.
- Can be dynamic based on incident context.
- Enhances compliance and operational security.
Memory trick: Permissions are like traffic lights, changing based on the incident's stage and who's driving.