Palo Alto Networks XSIAM Analyst - XSIAM-Analyst 模擬練習

A. The indicator verdict was manually set to Suspicious.

B. The indicator has been excluded.

C. The indicator is expired.

D. The indicator exists as an IOC rule.

A. Indicator query

B. Detection rule

C. Action center

D. Alert

A. XQL Helper

B. Schema

C. Query Results

D. Query Library

A. The analyst must manually star incidents after determining which alerts within the incident were automatically starred.

B. Starring configuration is applied to the newly created alerts, and the incident is subsequently starred.

C. It takes 48 hours for the configuration to take effect.

D. Starring is applied to alerts after they have been merged into incidents, but incidents are not starred.

A. Run the core commands directly from the Command and Scripts menu inside playground.

B. Run the core commands directly by typing them into the playground CLI.

C. Run the core commands directly from the playground and invite other collaborators.

D. Create a playbook with the commands and run it from within the War Room.

A. They can be uploaded using REST API.

B. They can be excluded using suppression rules but not alert exclusions.

C. They can be used to detect a specific registry key.

D. They can have an expiration date of up to 180 days.

A. Add the C-level executive users to the Executive Accounts asset role.

B. Create a dynamic group for the C-level hosts.

C. Create a Featured Alert field for the C-level hosts.

D. Add a tag to the C-level executive users.

A. The artifact verdict has changed from a previous state to "Malware."

B. The malware requires further analysis.

C. The malicious artifact was injected.

D. The WildFire verdict returned is "Low Confidence."