XSIAM-ANALYST · Question #48
An incident in Cortex XSIAM contains the following series of alerts: 10:24:17 AM - Informational Severity - XDR Analytics BIOC - Rare process execution in organization 10:24:18 AM - Low Severity…
The correct answer is A. Rare process execution in organization. An incident is opened by the first alert that triggers it. The earliest alert here is at 10:24:17 AM ("Rare process execution in organization"), so that alert created the incident.
Question
An incident in Cortex XSIAM contains the following series of alerts:
10:24:17 AM - Informational Severity - XDR Analytics BIOC - Rare process execution in organization 10:24:18 AM - Low Severity - XDR BIOC - Suspicious AMSI DLL load location 10:24:20 AM - Medium Severity - XDR Agent - WildFire Malware 11:57:04 AM - High Severity - Correlation - Suspicious admin account creation Which alert was responsible for the creation of the incident?
Options
- ARare process execution in organization
- BSuspicious admin account creation
- CWildFire Malware
- DSuspicious AMSI DLL load location
How the community answered
(48 responses)- A83% (40)
- B2% (1)
- C10% (5)
- D4% (2)
Explanation
An incident is opened by the first alert that triggers it. The earliest alert here is at 10:24:17 AM ("Rare process execution in organization"), so that alert created the incident.
Topics
Community Discussion
No community discussion yet for this question.