Palo Alto Networks Certified Security Automation Engineer (PCSAE - Cortex XSOAR) Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  All is wrong based on this https://xsoar.pan.dev/docs/reference/packs/incident-lifecycle#classification-and-mapping Ingest > classification > mapping > incident creation

• 4

  Stage One: Event-Data Ingestion The incident lifecycle begins when an integration fetches an event. You can configure integrations in Cortex XSOAR to fetch event data from various sources, such as a SIEM, EDR, a firewall, and other security systems and services. Stage Two: Incident Object Creation Cortex XSOAR uses the event data fetched by an integration to create an incident object and populates it with raw event data. Stage Three: Classification Cortex XSOAR identifies the type of incident based on the classifier object selected in the integration configuration settings. If you have not selected any classifier, then the integration uses the default classifier of the integration. Cortex XSOAR will identify an incident as Unclassified if no default classifier exists or if the type of an incident cannot be identified. Stage Four: Mapping The raw event data ingested by an integration gets mapped to existing fields in Cortex XSOAR. The fields display incident data to analysts in the Cortex XSOAR graphical user interface (GUI). Ingestion >> Incident Creation >> Classification >> Mapping is the 100% correct answer

• 14

  I do not think so. It should be like that: Integration performs Classification is applied Mapping is applied Incident is created (before incident creation it should be also pre-process rule step)