Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementMedium
A security analyst needs to generate a report showing the average time to resolution for 'Malware' incidents over the last quarter, broken down by assignee. Which Cortex XSOAR feature would allow them to easily visualize this data and export it for a management review?
- AWar Room logs
- BPlaybook task reports
- CIncident Correlation rules
- DDashboards and Widgets
Show answer & explanationAnswer & explanation
Correct answer: D. Dashboards and Widgets
Cortex XSOAR Dashboards provide customizable visualizations (widgets) that can aggregate and display incident metrics like average time to resolution, filtered by incident type or assignee, and can be exported for reporting purposes.
Why the other options are wrong
- A. War Room logs contain command outputs and analyst comments, but do not provide aggregated metrics or visualizations.
- B. Playbook task reports focus on playbook execution status, not overall incident resolution metrics aggregated by assignee.
- C. Incident Correlation rules are for linking related incidents, not for reporting on resolution times.
Cortex XSOAR Dashboards
Cortex XSOAR Dashboards are customizable interfaces composed of widgets that visualize incident data, metrics, and trends in real-time. They provide a high-level overview of security operations and performance.
- Contain multiple widgets for different data views.
- Can filter data by incident type, owner, status, etc.
- Support various chart types (bar, pie, table, etc.).
- Essential for operational monitoring and management reporting.
Memory trick: Dashboards display data, Correlation connects, War Room chat, Playbooks automate.