Paloalto Networks PCSAE Dumps

Define the Incident Fetch Interval when running the integration’s commands.

Duplicate the integration. Edit the resulting copy and add incidentFetchInterval as a parameter. Save the integration. Configure the new integration instance with the interval required.

Configure the application to send incidents on the required interval.

Duplicate the integration. Add the interval in the code. Save the integration and Configure the new integration instance with the interval required.

Create content and add it to the standard content by contributing through the Marketplace

Use the XSOAR GitHub Contribution Guide to add the contribution to the standard content

Create a support ticket with the custom content for review by the support team

Any custom content will be automatically uploaded to the content repository

Define input key in the subplaybook task. Map context values to pull from parent playbook.

The output of the previous task automatically becomes the input of the subplaybook.

Map inputs and outputs to the parent playbook and the subplaybook will use the same values.

Open the subplaybook and add inputs or outputs in the Playbook triggered task.

The ’Fetches Incidents’ option may not have been enabled

There are no new events from the external service

The first fetch should be manually triggered to start the fetching process

It can take up to 1-hour before incidents are initially fetched

Section headers

Rows

Canvas

Cards

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with no argument

Edit the incident layout to add a new button that calls the AssignToMeButton automation with argument assignBy={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument owner={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument assignBy=current

Allows reverting back to a previous version of a content pack

Enables users to participate in the community by sharing content

Publishes content without additional review from the Cortex XSOAR team

Allows uploading of content in additional languages

Offers granularity in installation through content packs

Create widget of type Line, check ‘Display Trend’ and define as 7 days ago

Create a custom widget using a new incident query

Create widget of type Number, check ‘Display Trend’ and define as 7 days ago

Create a custom widget using a script

Create a new indicator type and disable the built-in IP indicator

Edit the regex of the default IP Indicator

Add a new server configuration key that will overwrite the default regex of the IP indicator

Delete the default IP indicator

10,080 minutes (7 days)

20,160 minutes (14 days)

21,600 minutes (15 days)

4,320 minutes (3 days)

Get DBotScore.value where DBotScore.Score (Larger or equals) 4

Get DBotScore.value where DBotScore.Score (equals (int)) 3

Get DBotScore where DBotScore.Score (Larger than) 1

Get DBotScore where DBotScore.Score (Larger or equals) 2

Incident Summary View

My Incidents

My Threat Landscape

My Dashboard

The new job form changes based on the threat intel feed integration configuration

The new job form can be edited from the Indicator Feed incident type editor

The new job form for a threat intel feed job cannot be edited

The new job form can be edited from the threat intel feeds integration settings

OTP token

User name and password

SAML

Active Directory authentication

RADIUS

Retrieve widget chart based on script

Related incidents

War room entries picked by entry query

Incident team members

type:File reputation:Malicious sourcetimestamp:"30 days ago"

type:File verdict:Malicious sourcetimestamp:<="30 days ago"

type:File reputation:Malicious sourcetimestamp:="30 days ago"

type:File verdict:Malicious sourcetimestamp:>="30 days ago"

/var/lib/demisto

/tmp/log/demisto

/usr/local/demisto

/var/log/demisto

Python

Perl

Go

JavaScript

Powershell

Dashboards

Threat Intel

Settings

Marketplace

Synchronous

Extract

Out of band

Inline

Get csvList.value where csvList.value equals test [from previous tasks]

Get csvList.value where csvList.value equals ${test} [from previous tasks]

Get csvList.value where csvList.value equals test {}[from previous tasks]

Get csvList.value where csvList.value equals test [as value]

Get csvList.value where csvList.value equals ${test} [as value]

Process all alerts by running the respective playbook and link related incidents during post-processing

Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together

Configure a pre-process rule to link related events as they are ingested

Manually go through the incidents created by the raw events and link related incidents