When viewing the incident directly, what is the “assigned to” field value of a new Incident that was just reported to Cortex?
When viewing the incident directly, what is the “assigned to” field value of a new Incident that was just reported to Cortex?
When a new incident is reported to Cortex, the 'assigned to' field value is 'Unassigned'. This is because the incident has not yet been assigned to any user for investigation. Incidents that have not been assigned are typically marked as 'Unassigned' until an analyst is specifically assigned to handle the case.
from Admin Guide: Assigned To: The user to which the incident is assigned. The assignee tracks which analyst is responsible for investigating the threat. Incidents that have not been assigned have a status of Unassigned. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Incidents
C is the right answer. It's the status field that will be set to New. The assigned to field will be set to Unassigned
C. is the right answer.
C. Unassigned
in the admin guide pg. 230
Unassigned
C. Unassigned