What must happen before a pre-process rule can be applied to a potential incident?

The correct answer is D. Classification. Before a pre-process rule can be applied, the incoming event must go through classification, which determines the incident type. Pre-process rules are tied to incident types and are applied immediately after classification but before ingestion, allowing actions like dropping…

Incident Management and Configuration

Question

Options

AMapping
BPlaybook execution
CIngestion
DClassification

How the community answered

(36 responses)

A
3% (1)
B
3% (1)
C
6% (2)
D
89% (32)

Explanation

Before a pre-process rule can be applied, the incoming event must go through classification, which determines the incident type. Pre-process rules are tied to incident types and are applied immediately after classification but before ingestion, allowing actions like dropping, merging, or modifying incidents based on their type.

Topics

#pre-process rules#incident ingestion#classification#incident pipeline

Community Discussion

No community discussion yet for this question.

Full XSOAR-ENGINEER Practice