Threat Response with Cortex XSIAM
Threat Response with Cortex XSIAM
This domain tests incident handling after detection: triage, containment, eradication, recovery, and closure. Expect the incident lifecycle, war room collaboration, response actions, and playbook-driven remediation.
Core rules
- Incidents have severity, status, assignee, and type. Triage confirms scope and impact before disruptive action.
- Response actions include endpoint isolation, file quarantine, process termination, and block lists for hashes, IPs, or domains. Isolation cuts network access but preserves the agent channel; quarantine moves a file.
- The war room holds evidence, tasks, and collaboration. Document decisions and collect artifacts before remediation.
- Playbooks automate containment and eradication, but high-impact actions should include manual approval.
- Close with a resolution reason and verify the threat is gone; reopening should be possible if verification fails.
Worked example
A malware incident fires on a finance workstation. The playbook isolates the endpoint, quarantines the file, blocks the hash, and opens a war room task for the analyst. Reasoning: isolation limits lateral movement first; quarantine removes the payload; hash blocking prevents spread; approval is not needed for a single workstation but would be for a domain controller. The analyst then checks for persistence and confirms no other hosts used the hash.
Traps
- Isolating a critical server without approval and causing an outage.
- Confusing quarantine with isolation.
- Closing an incident after blocking a hash without checking persistence or lateral movement.
- Skipping evidence collection before remediation.
- Leaving the status as New after response actions, which breaks metrics and SLA tracking.