Your organization requires a 'Chain of Custody' section on every critical incident in XSIAM, which must include: the exact timestamp of initial detection, who first triaged it, and the last person to modify the incident. This data is partially available from XSlAM's audit logs and incident lifecycle fields. Design an XSIAM incident layout optimization that automatically populates and displays this information, even if specific fields aren't explicitly part of the default incident schema.
正解：B
To automatically populate and display 'Chain of Custody' information within the XSIAM incident layout, even from non-default schema fields, the most robust approach is to create a custom incident layout section. This section would house custom fields that leverage advanced XQL queries (including lookups against audit logs for user actions and timestamps) to extract the necessary data. Utilizing Field Transformers or Renderers would ensure the data is presented clearly and dynamically updates with the incident's lifecycle. Options A, C, D, and E are either manual, external, or do not provide this integrated, automated view within the incident itself.
