An incident has been created in the following state: - There is no playbook attached. - The War Room is available, but no commands have been run yet. What is the status of the incident?

The correct answer is A. Active. In Cortex XSOAR, once an incident is created, it is immediately placed in the Active state, even if no playbook is attached and no War Room activity has started. This status indicates the incident exists and is available for investigation or automation.

Incident Management and Configuration

Question

An incident has been created in the following state:

There is no playbook attached.
The War Room is available, but no commands have been run yet.

What is the status of the incident?

Options

AActive
BPending
CWaiting
DIn-progress

How the community answered

(42 responses)

A
90% (38)
B
5% (2)
C
2% (1)
D
2% (1)

Explanation

In Cortex XSOAR, once an incident is created, it is immediately placed in the Active state, even if no playbook is attached and no War Room activity has started. This status indicates the incident exists and is available for investigation or automation.

Topics

#incident status#Active status#incident lifecycle#War Room

Community Discussion

No community discussion yet for this question.

Full XSOAR-ENGINEER Practice