SecOps ProDemo

By Palo Alto Networks · Question Mode

QuestionQ24

Cortex XSOAR

Which Cortex XSOAR feature can run a particular integration command to enrich an IP address without leaving the incident view, while ensuring that the action is recorded in the incident's history?

  • A War Room
  • B Work plan
  • C Playground
  • D Evidence board
Explanation

The War Room supports running integration commands directly during an incident investigation and serves as the incident’s audit trail for manual and automated actions. It therefore enables IP enrichment in the incident workspace while preserving the command activity in the incident record.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!