Palo Alto Networks Certified Security Automation Engineer (PCSAE)Automation and OrchestrationEasy
A security operations team uses Cortex XSOAR for incident response. During a critical incident, they need to quickly gather information from various security tools (e.g., firewall logs, EDR alerts, cloud activity logs) and present a unified timeline of events to the incident commander. Which XSOAR capability best facilitates the aggregation and chronological display of disparate security events into a single, comprehensive view?
- AWar Room
- BAutomated Integrations
- CCustom Dashboards
- DPlaybook Canvases
Show answer & explanationAnswer & explanation
Correct answer: A. War Room
The War Room in Cortex XSOAR is specifically designed to be a central hub for incident investigation, aggregating all collected evidence, commands, and events into a chronological, searchable timeline, providing a unified view for responders.
Why the other options are wrong
- B. Automated Integrations connect XSOAR to other tools but don't inherently provide the unified timeline view.
- C. Custom Dashboards provide high-level metrics and visualizations, not a granular chronological event timeline for a specific incident.
- D. Playbook Canvases are for designing workflows, not for displaying incident data.
Cortex XSOAR War Room
A central, collaborative environment within Cortex XSOAR where incident responders can investigate, execute commands, and view all incident-related evidence and events in a chronological timeline.
- Aggregates all incident data.
- Provides a chronological event timeline.
- Facilitates collaboration and investigation.
Memory trick: The WAR ROOM shows the whole story, step by step.