Examice

Exam PCSAE All QuestionsBrowse all questions from this exam

Question 76

A playbook task generates a report as HTML in the context data.

An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the engineer populate the HTML field in the indicator layout?

Populate the custom indicator field with the built-in !SetIndicator command.

Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field.

Create a custom Indicator Mapper and populate the custom indicator field.

Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.

Correct Answer: C

To populate a custom indicator field of type HTML, the engineer needs to use a custom Indicator Mapper. This approach allows for direct mapping of data from the context data to the custom field created in the indicator layout. While other methods could involve setting the field value indirectly or manually, creating a custom Indicator Mapper specifically for this task ensures accurate and automatic population of the custom HTML field in the indicator layout.

Discussion

piipoOption: A

!setindicator

piipo

D may be correct. https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.8/Cortex-XSOAR-Threat-Intel-Management-Guide/Map-Custom-Indicator-Fields

heromanxxx

https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/automation-output-in-indicator-or-incident-layout/td-p/514031

SarpppOption: A

!setindicator command is needed to pull context data and move it to the indicator.