XSIAM Analyst flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Playbook trigger

A binding that starts a playbook when an alert or incident matches a defined query and object type. The query is evaluated as new objects arrive.

War Room

Per-incident console where analysts run commands and playbooks manually and inspect each task's inputs and outputs during troubleshooting.

demisto object

Python object available inside automation scripts. It exposes methods such as args(), executeCommand(), results(), and incidents() for interacting with the platform.

Conditional task

Playbook task that evaluates a condition and routes execution down a true or false branch. The default branch handles unmatched cases.

Job scheduling

Platform feature that runs a script or playbook on a recurring cron-like schedule, used for periodic enrichment, cleanup, or reporting tasks.

Mapper

Configuration that translates raw alert fields into incident fields. Unmapped fields cause playbook filters referencing them to fail.

Task input mapping

Assignment of a task's inputs from parent context, literal values, or prior task outputs. Incorrect mapping is a common automation failure cause.

Loop iteration limit

Maximum number of times a playbook task may repeat. Exceeding the limit fails the task and prevents infinite loops.

System playbook

Built-in playbook provided by the platform. It cannot be deleted; analysts disable it or duplicate it to create an editable copy.

Integration instance

A configured connection to an external product using credentials and a server URL. Commands fail if the instance is disabled or misconfigured.

XQL

Query language used in Cortex XSIAM to search datasets. Queries use pipe-separated stages such as filter, fields, sort, and limit.

XDM normalization

Schema that maps vendor-specific log fields into standard field names, allowing detections to work consistently across different data sources.

BIOC rule

Behavioral indicator of compromise: custom detection logic written in XQL that generates an alert when its condition matches event data.

Correlation rule

Detection rule that combines multiple alerts or events over a time window to produce a higher-confidence alert and reduce noise.

Alert severity vs confidence

Severity reflects potential impact of an alert; confidence reflects certainty the detection is correct. Both fields can drive routing and prioritization.

MITRE ATT&CK mapping

Tactic and technique tags attached to detections and alerts, used for coverage gap analysis and reporting on defensive posture.

Alert suppression

Rule that hides matching alerts to reduce false positives. It must be scoped by specific field values to avoid hiding true positives.

Causality chain

Graph linking related alerts and events into a sequence, letting analysts see how an incident unfolded rather than reviewing isolated alerts.

Endpoint data source

Telemetry collected by the Cortex XDR agent on a host, including process, file, network, and registry events used for detection.

Dataset selection

The first part of an XQL query that names the data source to search, such as endpoint or network telemetry tables.

Time range in XQL

The query window is set in the query interface, not in the query body. The same query returns different results for different ranges.

Incident lifecycle

States an incident passes through, including new, under investigation, and closed. Closing requires selecting a resolution reason.

Endpoint isolation

Response action that blocks a host's network traffic except the management channel to the platform, keeping analyst control while containing spread.

Quarantine file

Response action that moves or blocks a malicious file on an endpoint so it cannot execute, typically after hash or behavior confirmation.

Terminate process

Response action that kills a running process on an endpoint. It stops active malicious behavior but does not remove the underlying artifact.

Containment vs remediation

Containment limits spread, such as isolating a host or blocking a hash. Remediation removes the artifact, such as quarantining a file.

Indicator blocklist

List of indicators such as file hashes, IPs, or domains that the platform blocks on endpoints according to policy scope.

Resolution reason

Field selected when closing an incident, such as true positive, false positive, or duplicate. Accurate selection keeps detection metrics reliable.

Role-based access

Permission model determining which analysts may execute destructive response actions such as isolate or quarantine versus read-only investigation.

Audit trail

Log of response actions recording the user, timestamp, and target for each action, supporting post-incident review and accountability.

Auto-isolation playbook

Response playbook that isolates an endpoint automatically when an alert matches defined severity or confidence conditions.

Live agent connection

Active communication between endpoint agent and platform. Response actions such as isolate or terminate require this connection to succeed.