Exam PCSAE topic 1 question 96 discussion

Actual exam question from Palo Alto Networks's PCSAE

Question #: 96
Topic #: 1

A playbook task generates a report as HTML in the context data.

An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the engineer populate the HTML field in the indicator layout?

A. Populate the custom indicator field with the built-in !SetIndicator command.
B. Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field.
C. Create a custom Indicator Mapper and populate the custom indicator field.
D. Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.

Show Suggested Answer

Suggested Answer: D 🗳️

by Sarppp at Aug. 20, 2023, 9:36 p.m.

Comments

Submit Cancel

Jai_ke

11 months ago

Selected Answer: D

D is correct. You need to map the HTML content generated by the playbook task directly to the custom HTML field in the indicator layout. The Mapping option allows you to specify how the output of the playbook task should be mapped to various fields, including custom HTML fields. !SetIndicator command, is generally used for setting the value of standard indicator fields but may not be the best choice for custom fields, especially those of type "HTML."

upvoted 1 times

...

piipo

1 year, 4 months ago

Selected Answer: A

!setindicator

upvoted 1 times

Jai_ke

11 months ago

The !SetIndicator command is generally used for setting values in indicator fields but may not be suitable for handling HTML content directly. So the answer is D.

upvoted 1 times

...

piipo

1 year, 3 months ago

D may be correct. https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.8/Cortex-XSOAR-Threat-Intel-Management-Guide/Map-Custom-Indicator-Fields

upvoted 2 times

heromanxxx

1 year, 2 months ago

https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/automation-output-in-indicator-or-incident-layout/td-p/514031

upvoted 1 times

...

Sarppp

1 year, 11 months ago

!setindicator command is needed to pull context data and move it to the indicator.

upvoted 1 times

...