Palo_Alto_Networks
PCSAE · Question #18
Incidents need to be filtered by all of the following criteria: 1. Status - Pending 2. Exclude Category - Job 3. Severity - High 4. Owner - None (No owner assigned) 5. Type - Phishing 6. Email…
The correct answer is C. status:Pending and -category:job and severity:High and owner:"" and type:Phishing and. https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar-admin/cortex-xsoar- overview/how-to-search-in-cortex-xsoar.html#idcd7fe505-c1c1-42f5-a698-08b5710196d3
Operations and Monitoring
Question
Incidents need to be filtered by all of the following criteria: 1. Status - Pending 2. Exclude Category - Job 3. Severity - High 4. Owner - None (No owner assigned) 5. Type - Phishing 6. Email Subject - "You have won a million dollars" What is the correct query syntax for the above incident search filter?
Options
- Astatus=="Pending" && category!="job" && severity=="High" && owner=="None" &&
- BStatus:Pending and -category:job and Severity:High and Owner:"" and Type:Phishing and Email
- Cstatus:Pending and -category:job and severity:High and owner:"" and type:Phishing and
- Dstatus:Pending or -category:job or severity:High or owner:"" or type:Phishing or emailsubject:"You
How the community answered
(48 responses)- A10% (5)
- B4% (2)
- C79% (38)
- D6% (3)
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar-admin/cortex-xsoar- overview/how-to-search-in-cortex-xsoar.html#idcd7fe505-c1c1-42f5-a698-08b5710196d3
Topics
#incident query syntax#search filters#query operators#incident fields
Community Discussion
No community discussion yet for this question.