In the SOAR main menu, there are sub-options below Sources. What is the purpose of these options?

Question

Options

• AThey permit analysts to select the app that is polled to create the containers.
• BThey filter the container list based on default or user-saved filters.
• CThey are only available for admins and would never be used by an analyst.
• DThey permit analysts to select cases related to an investigation.

• B
  90% (27)
• C
  3% (1)
• D
  7% (2)

Explanation

In SOAR platforms, the sub-options beneath Sources in the main menu act as filters, allowing analysts to quickly narrow the container list to only those originating from a specific source - this is exactly what option B describes. Option A is wrong because the app being polled is configured at the ingestion/integration level, not through a main menu filter. Option C is wrong because these filter options are commonly used by analysts, not restricted to admins. Option D is wrong because "cases related to an investigation" describes a different SOAR concept (case management), not source filtering.

Memory tip: Think of "Sources" as a funnel - sub-options let you filter down what you see, not configure where data comes from. If you remember "Sources = filter by origin," you'll avoid confusing it with configuration or case-management features.

No community discussion yet for this question.