Professional Security Operations Engineer

By Google · Question Mode

QuestionQ2

Incident response

The organization requires that the SOC director be notified by email about escalated incidents and their results before a case is closed. You need to create a process that automatically sends this email when an escalated case is closed. You must ensure that the email is sent reliably for the appropriate cases. Which process should you use?

Explanation

Cortex XSOAR playbooks automate security workflows, and conditional tasks direct the workflow based on field values or parameters. A conditional branch can check the escalation status, send the director an email containing the relevant notes for escalated cases, and close cases without that email when they were not escalated. This makes notification part of the controlled closure workflow.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!