XSIAM-ANALYST · Question #24
Two security analysts are collaborating on complex but similar incidents. The first analyst merges the two incidents into one for easier management. The other analyst immediately discovers that the…
The correct answer is A. Unmerge the incidents to capture the missing details. When incidents are merged in Cortex XSIAM, custom field values from the source (secondary) incident are not always automatically transferred to the destination (primary) incident. The recommended way to retrieve the missing custom incident field values is to unmerge the This…
Question
Two security analysts are collaborating on complex but similar incidents. The first analyst merges the two incidents into one for easier management. The other analyst immediately discovers that the custom incident field values relevant to the investigation are missing. How can the team retrieve the missing details?
Options
- AUnmerge the incidents to capture the missing details
- BCheck the timeline view of the incident.
- CCheck the War Room of the destination incident.
- DExamine the incident context of the source incident.
How the community answered
(37 responses)- A78% (29)
- B5% (2)
- C3% (1)
- D14% (5)
Explanation
When incidents are merged in Cortex XSIAM, custom field values from the source (secondary) incident are not always automatically transferred to the destination (primary) incident. The recommended way to retrieve the missing custom incident field values is to unmerge the This action restores the original incidents, including all their individual fields and context, allowing analysts to access and capture the missing details. "If incident field values are missing after a merge, unmerging incidents will restore the original context and custom field data from each incident."
Topics
Community Discussion
No community discussion yet for this question.