Palo_Alto_Networks
SECOPS-PRO · Question #2
A new incident in Cortex XSIAM contains WildFire malware and Behavioral Threat Protection (BTP) alertsout an unsigned process attempting to dump the memory of Isass.exe. Which initial verdict applies
The correct answer is B. True positive. Alerts from WildFire and Behavioral Threat Protection on an unsigned process dumping LSASS memory indicate malicious activity, making it a true positive.
Incident Response
Question
A new incident in Cortex XSIAM contains WildFire malware and Behavioral Threat Protection (BTP) alertsout an unsigned process attempting to dump the memory of Isass.exe. Which initial verdict applies to this incident?
Options
- AFalse positive
- BTrue positive
- CFalse negative
- DTrue negative
How the community answered
(32 responses)- A9% (3)
- B72% (23)
- C3% (1)
- D16% (5)
Explanation
Alerts from WildFire and Behavioral Threat Protection on an unsigned process dumping LSASS memory indicate malicious activity, making it a true positive.
Topics
#Cortex XSIAM#WildFire#BTP#incident triage
Community Discussion
No community discussion yet for this question.