XSIAM EngineerDemo

Question

An engineer views Medium-severity alerts in Cortex XSIAM using the filter shown below:

Question Image

How can future alerts be changed from Medium to High severity?

A Create a starring configuration rule for high severity.
B Create a playbook with a task to change the severity to high, then create a playbook trigger for the alert.
C Create a similar behavioral indicator of compromise (BIOC) rule that will have a severity of high, enable it, then disable the original BIOC rule.
D Create a scoring rule that will assign a score of 100 to that specific alert.

Explanation

XDR Analytics BIOC alert severity is defined by the BIOC rule that generates the alert. Replacing the medium-severity rule with an enabled equivalent BIOC rule configured for High severity causes subsequent matching detections to be generated as High severity. Starring does not affect severity, and scoring rules assign numeric scores rather than changing the BIOC alert’s severity.

Learn more

XSIAM EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ91

Community Discussion