XSIAM-ANALYST · Question #20
During an investigation of an alert with a completed playbook, it is determined that no indicators exist from the email "[email protected]" in the Key Assets & Artifacts tab of the parent incident…
The correct answer is B. !checkIndicatorExtraction text="[email protected]". checkIndicatorExtraction tests the current indicator extraction settings and shows whether the provided text (here, the email) would be extracted, confirming the configuration is working as
Question
During an investigation of an alert with a completed playbook, it is determined that no indicators exist from the email "[email protected]” in the Key Assets & Artifacts tab of the parent incident. Which command will determine if Cortex XSIAM has been configured to extract indicators as expected?
Options
- A!createNewIndicator value="[email protected]"
- B!checkIndicatorExtraction text="[email protected]"
- C!extractIndicators text="[email protected]" auto-extract=inline
- D!emailvalue="[email protected]"
How the community answered
(46 responses)- A2% (1)
- B78% (36)
- C7% (3)
- D13% (6)
Explanation
checkIndicatorExtraction tests the current indicator extraction settings and shows whether the provided text (here, the email) would be extracted, confirming the configuration is working as
Topics
Community Discussion
No community discussion yet for this question.