Assuming an incident type configuration runs the associated playbook automatically, which pre- process rule action can preserve matching incidents without triggering the playbook?

The correct answer is B. Update. A pre-process rule with the "Update" action preserves matching incidents by updating an existing one instead of creating a new one. This prevents the playbook from being automatically triggered for every match while still retaining the incident data.

Incident Management and Configuration

Question

Options

AClose
BUpdate
CDrop
DLink

How the community answered

(59 responses)

A
3% (2)
B
78% (46)
C
7% (4)
D
12% (7)

Explanation

A pre-process rule with the "Update" action preserves matching incidents by updating an existing one instead of creating a new one. This prevents the playbook from being automatically triggered for every match while still retaining the incident data.

Topics

#pre-process rules#playbook trigger#update action#incident preservation

Community Discussion

No community discussion yet for this question.

Full XSOAR-ENGINEER Practice