Refer to the exhibits. The Malicious File Detect playbook is configured to create an incident when an event handler generates a malicious file detection event. Why did the Malicious File Detect…

The correct answer is A. The Create Incident task was expecting a name or number as input, but received an incorrect. The raw logs show a Jinja2 TemplateSyntaxError originating in the incident operator's parse_input routine ("expected name or number; 14784"), which means the Create Incident step couldn't render its template because the input field was malformed. That error caused the Create…

FortiAnalyzer for SOC

Question

Refer to the exhibits. The Malicious File Detect playbook is configured to create an incident when an event handler generates a malicious file detection event. Why did the Malicious File Detect playbook execution fail?

Exhibit

Options

AThe Create Incident task was expecting a name or number as input, but received an incorrect
BThe Get Events task did not retrieve any event data.
CThe Attach_Data_To_lncident incident task wasexpecting an integer, but received an incorrect
DThe Attach Data To Incident task failed, which stopped the playbook execution.

How the community answered

(54 responses)

A
67% (36)
B
4% (2)
C
9% (5)
D
20% (11)

Explanation

The raw logs show a Jinja2 TemplateSyntaxError originating in the incident operator's parse_input routine ("expected name or number; 14784"), which means the Create Incident step couldn't render its template because the input field was malformed. That error caused the Create Incident task to fail first and left the Attach Data task upstream‑failed.

Topics

#playbook troubleshooting#Create Incident task#playbook execution failure#input validation

Community Discussion

No community discussion yet for this question.

Full NSE7_SOC_AR-7.6 Practice