How can a Cortex XSIAM engineer resolve the issue when a SOC analyst escalates missing details after merging two similar incidents?

The correct answer is A. Check the War Room of the destination incident. When two incidents are merged in Cortex XSIAM, the War Room of the destination incident retains the merged details and activity logs. If a SOC analyst reports missing details, checking the destination incident's War Room will provide the complete context and history.

Incident Management and Response

Question

Options

ACheck the War Room of the destination incident.
BExamine the incident context of the source incident.
CUnmerge the incidents and copy the missing details into the incident notes.
DCheck the child incident of the destination incident.

How the community answered

(35 responses)

A
77% (27)
B
3% (1)
C
11% (4)
D
9% (3)

Explanation

When two incidents are merged in Cortex XSIAM, the War Room of the destination incident retains the merged details and activity logs. If a SOC analyst reports missing details, checking the destination incident's War Room will provide the complete context and history.

Topics

#incident merge#War Room#missing incident details#incident management

Community Discussion

No community discussion yet for this question.

Full XSIAM-ENGINEER Practice