XSIAM-Engineer資格トレーリング質問70：A Security Operations Center (SOC) using Palo Alto Networks XSIAM is experiencing alert fatigue due to

<<前へ次へ>>

質問 70/73

A Security Operations Center (SOC) using Palo Alto Networks XSIAM is experiencing alert fatigue due to the high volume of low-fidelity alerts, impacting their ability to prioritize critical incidents. The current incident layout in XSIAM presents all alert fields equally. As an XSIAM engineer, what content optimization strategy would you implement to improve incident responder efficiency and reduce MTTR for critical incidents?

A. Implement an alert suppression rule for all low-fidelity alerts based on their severity score. B. Redesign the incident layout to prominently display key indicators of compromise (IOCs), MITRE ATT&CK techniques, and affected assets at the top, leveraging XSIAM's incident layout customization features. C. Integrate a third-party SIEM to filter out non-critical alerts before they reach XSIAM. D. Increase the number of SOC analysts to handle the alert volume more effectively. E. Configure all alerts to automatically close after 24 hours if no action is taken.

質問 70/73

コメントを発表する

Download PDF File