Which two actions will allow a security analyst to review updated commands from the core pack and interpret the results without altering the incident audit? (Choose two.)

The correct answer is B. Run the core commands directly by typing them into the playground CLI. C. Run the core commands directly from the Command and Scripts menu inside playground. Executing core pack commands in the Playground - either by typing them in the CLI or selecting them from Command & Scripts - lets you test and view results without writing anything to an incident's War Room audit trail.

Incident Investigation and Response

Question

Options

ACreate a playbook with the commands and run it from within the War Room.
BRun the core commands directly by typing them into the playground CLI.
CRun the core commands directly from the Command and Scripts menu inside playground.
DRun the core commands directly from the playground and invite other collaborators.

How the community answered

(26 responses)

A
19% (5)
B
73% (19)
D
8% (2)

Explanation

Executing core pack commands in the Playground - either by typing them in the CLI or selecting them from Command & Scripts - lets you test and view results without writing anything to an incident's War Room audit trail.

Topics

#playground CLI#War Room#core pack commands#incident audit

Community Discussion

No community discussion yet for this question.

Full XSIAM-ANALYST Practice