Palo Alto Networks Certified Security Automation Engineer (PCSAE)Automation and OrchestrationMedium
A security analyst is investigating a potential insider threat where an employee is suspected of accessing sensitive files outside of their normal working hours. The analyst needs to quickly gather information about the user's recent login activity, file access logs, and generate a report of all network connections made by the user's workstation in the last 24 hours. This process needs to be consistent and produce a standardized output for review by management. Which Cortex XSOAR output type is best suited for presenting this aggregated and structured information?
- AIncident War Room Entries
- BAutomation Script Outputs
- CCustom Reports and Dashboards
- DRaw Playbook Logs
Show answer & explanationAnswer & explanation
Correct answer: C. Custom Reports and Dashboards
Custom Reports and Dashboards in Cortex XSOAR are specifically designed to aggregate data from various sources within an incident, present it in a structured and standardized format (e.g., tables, charts), and provide a comprehensive overview for management review and decision-making.
Why the other options are wrong
- A. Incident War Room Entries are a chronological log of actions and comments, not a structured report summarizing data.
- B. Automation Script Outputs are individual results from specific scripts, not a consolidated, formatted report.
- D. Raw Playbook Logs are detailed technical logs for debugging, not for management review.
Cortex XSOAR Custom Reports
Configurable documents generated within Cortex XSOAR that compile and present incident data, investigation findings, and automation results in a structured, human-readable format.
- Aggregates data from multiple sources within an incident.
- Provides a standardized output for management and auditors.
- Can include tables, charts, and narrative summaries.
Memory trick: Reports and Dashboards: show the story clearly.