Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementEasy
A SOC manager wants to create a new incident type in Cortex XSOAR for 'Insider Threat'. This incident type needs to have a unique set of custom fields specifically for insider threat investigations, such as 'Employee ID', 'Department', and 'Access Level'. Which configuration step is crucial for ensuring these custom fields are displayed only for 'Insider Threat' incidents?
- ACreate the custom fields globally and make them mandatory for all incident types.
- BModify the default incident layout to include the new fields, then apply it to the 'Insider Threat' incident type.
- CAdd the custom fields directly to the 'Insider Threat' playbook.
- DDefine the custom fields and then associate them with the 'Insider Threat' incident type in the incident type's configuration.
Show answer & explanationAnswer & explanation
Correct answer: D. Define the custom fields and then associate them with the 'Insider Threat' incident type in the incident type's configuration.
To ensure custom fields are displayed only for a specific incident type, they must first be defined and then explicitly associated with that incident type within its configuration settings. This allows for tailored data collection per incident category.
Why the other options are wrong
- A. Making fields mandatory globally would display them for all incident types, which is not the requirement.
- B. Modifying the default layout would affect all incident types using that layout, and the association needs to happen at the incident type level first.
- C. Adding fields to a playbook only makes them accessible within that playbook's context, not as part of the incident's core data fields.
Incident Type Custom Fields
Cortex XSOAR allows administrators to define custom incident fields and associate them with specific incident types. This ensures that only relevant data fields are presented to analysts for different categories of incidents.
- Custom fields enhance data granularity.
- Association with incident types tailors the user experience.
- Prevents clutter by hiding irrelevant fields.
- Improves data quality and reporting accuracy.
Memory trick: Fields for types, not for all; Specific needs, stand up tall.