Which of the following represents the correct relation of alerts to incidents?
Which of the following represents the correct relation of alerts to incidents?
Alerts with the same causality chains that occur within a given time frame are grouped together into an Incident. This grouping helps to manage and investigate related security events more efficiently by associating alerts that likely originate from the same root cause or attack chain.
Alerts on the same causality chain are grouped with the same incident if an open incident already exists. Otherwise, the new incoming alert will create a new incident. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Investigate-Incidents
I vote C
I vote C
I vote C
I vote C
found in the admin guide link
A is %100 wrong