During an investigation of an alert with a completed playbook, it is determined that no indicators exist from the email "indicator@test.com" in the Key Assets & Artifacts tab of the parent incident. Which command will determine if Cortex XSIAM has been configured to extract indicators as expected?

A. !createNewIndicator value="indicator@test.com"

B. !checkIndicatorExtraction text="indicator@test.com"

C. !extractIndicators text="indicator@test.com" auto-extract=inline

D. !emailvalue="indicator@test.com"

Palo_Alto_Networks

XSIAM-ANALYST · Question #20

During an investigation of an alert with a completed playbook, it is determined that no indicators exist from the email "[email protected]" in the Key Assets & Artifacts tab of the parent incident…

Sign in or unlock XSIAM-ANALYST to reveal the answer and full explanation for question #20. The question stem and answer options stay visible for context.

Threat Intelligence Management

Question

During an investigation of an alert with a completed playbook, it is determined that no indicators exist from the email "[email protected]” in the Key Assets & Artifacts tab of the parent incident. Which command will determine if Cortex XSIAM has been configured to extract indicators as expected?

Options

A!createNewIndicator value="[email protected]"
B!checkIndicatorExtraction text="[email protected]"
C!extractIndicators text="[email protected]" auto-extract=inline
D!emailvalue="[email protected]"

Unlock XSIAM-ANALYST to see the answer

You've previewed enough free XSIAM-ANALYST questions. Unlock XSIAM-ANALYST for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.

Unlock XSIAM-ANALYST - $49.99 / 30 days Sign in

Topics

#indicator extraction#email indicator#checkIndicatorExtraction#playbook diagnostics

Full XSIAM-ANALYST Practice