Which statement applies to a low-severity alert when a playbook trigger has been configured?

The correct answer is A. The alert playbook will automatically run when grouped in an incident. When a playbook trigger is configured for an alert--regardless of severity-- the playbook will automatically run when the alert is grouped into an incident, unless a severity condition is specifically configured in the playbook trigger. By default, the playbook will execute for…

Playbook Development and Automation

Question

Options

AThe alert playbook will automatically run when grouped in an incident.
BThe alert playbook can be manually run by an analyst.
CThe alert playbook will run if the severity increases to medium or higher.
DOnly low-severity analytics alerts will automatically run playbooks.

How the community answered

(40 responses)

A
93% (37)
B
5% (2)
D
3% (1)

Explanation

When a playbook trigger is configured for an alert--regardless of severity-- the playbook will automatically run when the alert is grouped into an incident, unless a severity condition is specifically configured in the playbook trigger. By default, the playbook will execute for any alert (including low severity) as soon as it is grouped within an incident. "A playbook that is configured as a trigger for an alert will automatically execute when that alert is grouped as part of an incident, independent of the alert's severity unless a specific severity threshold is set."

Topics

#playbook triggers#alert severity#low-severity alerts#automated playbook execution

Community Discussion

No community discussion yet for this question.

Full XSIAM-ANALYST Practice