A SOC lead wants to apply playbook logic to progress an incident investigation before escalating a case without shifting to an unrelated XSIAM function. Which choice is best?

Question

Accepted Answer

D. Incident response playbook. Incident response playbook is correct because the official Palo Alto Networks XSIAM Analyst datasheet maps it to playbooks for automated incident response. That makes it the best fit when the analyst needs to apply playbook logic to progress an incident investigation before escalating a case. Sub-playbooks is not correct because it addresses a different requirement within Automation and Playbooks.

A SOC lead wants to apply playbook logic to progress an incident investigation before escalating a case without shifting to an unrelated XSIAM function. Which choice is best?

Related Questions

Discussion