Select the correct incident life cycle on XSOAR.
Which two input requirements are needed to train a machine learning model? (Choose two.)
An engineer notices that playbooks only start once the user clicks the ‘investigate’ button and he/she would like the playbook to start automatically.
How can this be implemented?
When creating an incident layout section, it is best to place long field values within which of the following?
A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?
Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)
Whar are possible war room result (entry) types?
What are the out-of-the-box aggregate values that can be applied on widgets data?
After enriching a username using Active Directory, an engineer would like to send an email to the user’s manager. However, this functionality is not part of the command output. The engineer checks with raw- response=true and notices that the manager’s email is returned, but not saved in the context.
How can the engineer save the data so it will be accessible?
Which of the following are valid methods to contribute custom content? (Choose three.)
TESTED 01 Dec 2025