Which of the following items cannot be modified once entered into SOAR?

Question

Options

• AA comment.
• BA note.
• CA container.
• DAn artifact.

• A
  1% (1)
• B
  1% (1)
• C
  4% (3)
• D
  93% (63)

Explanation

Artifacts (D) are immutable by design in SOAR platforms - once an artifact is created, it cannot be edited. This preserves the forensic integrity of evidence collected during an investigation, ensuring the chain of custody remains untampered for analysis or legal purposes.

Comments (A) and Notes (B) are both user-generated, free-form text entries that can be edited or deleted after creation, as they represent analyst observations rather than evidentiary data. Containers (C) are the parent case/event objects that hold all related artifacts and data; their metadata (status, severity, owner) can be updated throughout the incident lifecycle.

Memory tip: Think of artifacts as evidence bags in a crime lab - once sealed and logged, you cannot alter what's inside without compromising the investigation. Everything else (notes, comments, containers) is just analyst paperwork that stays editable.

No community discussion yet for this question.