SIRI Day 2 Review

What is the correct table name for the Events which are used to create alerts, and possibly incidents or security incidents?

• sysevent

• sn_sec_event

• em_event

• sn_si_event

Security Tags can be used to restrict access to a record.

• True

• False

Security Incidents can be automatically assigned to users based on which attributes? (Choose multiple answers.)

• Location

• Skills

• Personal Preference

• Time Zone

• Hair Color

Which of the following statements is true about Security Incident Calculators? (Select several answers.)

• A calculator group can update multiple fields.

• Only one calculator rule will run within a Calculator Group

• Conditions can be setup at the Calculator Rule Level

• Calculator Rules are always scripted

True or False: When calculator rules within a Calculator Group run, they run based on order value and when the conditions of a rule are met, then no additional rules will be processed.

• True

• False

True or False: In the baseline, anyone assigned to a Security Incident will receive a Post Incident Review questionnaire

• True

• False

What new features for security incident response were added in San Diego? (Select multiple answers)

• Major Security Incident Management (MSIM)

• Data Loss Prevention (DLP) Incident Response

• Minor Security Incident Management (MSIM)

• Flow Designer and Integration Hub

What are the two newest automation capabilities for SecOps? (Select two answers.)

• Orchestration

• Flow Designer

• Workflow Editor

• Integration Hub

A runbook references what item?

• Knowledge Article

• Catalog Item

• Security Incident

• Playbook

Which of the following makes a playbook appear for a security incident? (Choose two answers)

• Workflow Trigger/Flow Trigger

• Playbook record > Conditions

• Adding the "sir_playbook" tag to a Flow

• Outcome Type field