During XSIAM operations, an analyst must isolate an endpoint as a response action during initial triage. Which concept or feature should they use?

Question

Accepted Answer

B. Endpoint isolation. Endpoint isolation is correct because the official Palo Alto Networks XSIAM Analyst datasheet maps it to endpoint isolation. That makes it the best fit when the analyst needs to isolate an endpoint as a response action during initial triage. Endpoint alerts and incidents is not correct because it addresses a different requirement within Endpoint Security Management.

During XSIAM operations, an analyst must isolate an endpoint as a response action during initial triage. Which concept or feature should they use?

Related Questions

Discussion