Refer to Exhibit. A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident. Which local connector action must the analyst use in this…

The correct answer is D. Attach Data to Incident. To add the details of a retrieved event into your incident record, you must use the Attach Data to Incident action on the Local Connector. This action takes the event payload (e.g. your high‑ severity alert) and appends it directly to the incident.

FortiAnalyzer for SOC

Question

Refer to Exhibit. A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident. Which local connector action must the analyst use in this scenario?

Exhibit

Options

AGet Events
BUpdate Incident
CUpdate Asset and Identity
DAttach Data to Incident

How the community answered

(19 responses)

A
11% (2)
C
5% (1)
D
84% (16)

Explanation

To add the details of a retrieved event into your incident record, you must use the Attach Data to Incident action on the Local Connector. This action takes the event payload (e.g. your high‑ severity alert) and appends it directly to the incident.

Topics

#playbook design#Attach Data to Incident#local connector#event filtering

Community Discussion

No community discussion yet for this question.

Full NSE7_SOC_AR-7.6 Practice