Palo Alto Networks Certified Security Automation Engineer (PCSAE)Automation and OrchestrationMedium
A large enterprise is struggling with a high volume of false positive alerts from its Security Information and Event Management (SIEM) system, leading to analyst fatigue and missed critical incidents. The security team wants to leverage Cortex XSOAR to reduce this noise and prioritize real threats more effectively. Which approach would best address this challenge?
- ACreate an orchestration workflow to correlate SIEM alerts with asset criticality and vulnerability data, then automatically close low-priority, non-impactful alerts.
- BIntegrate a threat intelligence feed to block all IPs and domains from the SIEM alerts.
- CImplement a machine learning model to predict future threats based on historical SIEM data.
- DDevelop a playbook to automatically generate compliance reports for all SIEM alerts.
Show answer & explanationAnswer & explanation
Correct answer: A. Create an orchestration workflow to correlate SIEM alerts with asset criticality and vulnerability data, then automatically close low-priority, non-impactful alerts.
Correlating SIEM alerts with asset criticality and vulnerability data provides crucial context to determine the true risk of an alert. Automating the closure of low-priority, non-impactful alerts based on this correlation significantly reduces false positives and noise, allowing analysts to focus on genuine threats.
Why the other options are wrong
- B. Blocking all IPs/domains from SIEM alerts without proper context could lead to legitimate service disruption and is not a refined false positive reduction strategy.
- C. Predicting future threats is proactive threat hunting, not directly addressing the current problem of high false positives from existing SIEM alerts.
- D. Generating compliance reports does not reduce false positives or prioritize alerts; it's a reporting function.
Alert Triage Automation
Automating the initial assessment and prioritization of security alerts to reduce false positives and focus analyst attention on high-fidelity threats.
- Leverages contextual data (e.g., asset criticality, threat intelligence, vulnerability status).
- Can automatically close or escalate alerts based on predefined rules.
- Reduces analyst fatigue and improves incident response efficiency.
Memory trick: Silence the noise, target the real threats.