Palo Alto Networks XSIAM Engineer — Question 31

A CISO has asked an engineer to create a custom dashboard in Cortex XSIAM that can be filtered to show incidents assigned to a specific user.
Which feature should be used to filter the incident data in the dashboard?

Answer options

• A. Filters and inputs in the custom dashboard
• B. Report template to set the incident user filter
• C. Visualization filter options in the widget configuration
• D. Incident summary view to filter by user

Correct answer: A

Explanation

The correct answer is A because using filters and inputs directly in the custom dashboard allows for specific customization, including filtering by user. Options B and D are less direct methods for filtering incidents, while C pertains to widget-specific configurations rather than overall dashboard filtering.