XSIAM-Analyst practice question 2 of 10

An incident in Cortex XSIAM contains the following series of alerts: 10:24:17 AM - Informational Severity - XDR Analytics BIOC - Rare process…

An incident in Cortex XSIAM contains the following series of alerts: 10:24:17 AM - Informational Severity - XDR Analytics BIOC - Rare process execution in organization 10:24:18 AM - Low Severity - XDR BIOC - Suspicious AMSI DLL load location 10:24:20 AM - Medium Severity - XDR Agent - WildFire Malware 11:57:04 AM - High Severity - Correlation - Suspicious admin account creation Which alert was responsible for the creation of the incident?

Answer options

A: Suspicious AMSI DLL load location

B: Rare process execution in organization Correct answer

C: Suspicious admin account creation

D: WildFire Malware

Correct Answer:

B. Rare process execution in organization

Explanation

In Cortex XSIAM, an incident is a container for one or more related alerts that represent a potential security event or attack. The incident is created at the moment the very first alert in a causality chain is detected. Subsequent related alerts are then correlated and grouped into this existing incident. According to the timeline provided, the "Rare process execution in organization" alert occurred at 10:24:17 AM, which is the earliest timestamp among all listed alerts. Therefore, this initial alert was responsible for the creation of the incident, and all subsequent alerts were added to it.

Why Incorrect

A. This alert occurred at 10:24:18 AM, after the incident was already created by the first alert. It was grouped into the existing incident.
C. This alert occurred significantly later at 11:57:04 AM and was correlated to the incident that had been open for over an hour.
D. This alert occurred at 10:24:20 AM, three seconds after the initial alert, and was consequently added to the already-created incident.

References

1. Palo Alto Networks Cortex XSIAM Administrator's Guide: Under the "Incidents" section, the concept of an incident is defined as a collection of related alerts. The system "groups alerts into incidents to provide a complete picture of an attack." The chronological ordering in the incident timeline demonstrates that the incident begins with the first detected alert. The creation event is tied to this first alert. (Reference: Cortex XSIAM Administrator's Guide, "Incident Concepts" section).

2. Palo Alto Networks Cortex XDR Administrator's Guide: The underlying logic is identical to Cortex XSIAM. The guide states, "Cortex XDR creates an incident when it receives the first alert that is part of a malicious causality chain." This explicitly confirms that the first alert in a sequence triggers the incident's creation. (Reference: Cortex XDR Administrator's Guide, "Incidents Overview" section).

Keep practicing

Take the free XSIAM-Analyst practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test