先試後買

A. Add the playbook to the integration's settings

B. Add the !startinvestigation automation to the beginning of the playbook

C. Select 'Run playbook automatically' from the incident type settings

D. Select 'Run playbook automatically' from the integration settings

A. Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together

B. Manually go through the incidents created by the raw events and link related incidents

C. Process all alerts by running the respective playbook and link related incidents during post-processing

D. Configure a pre-process rule to link related events as they are ingested

A. F - Unreliable, A - Completely Reliable

B. F - Not usually reliable, A - Fairly Reliable

C. F - Not reliable, A - Usually Reliable

D. F - Reliability cannot be judged, A - Completely Reliable

A. All context data, except the incident key will be deleted.

B. All context data, including custom incident fields will be deleted, system incident fields will remain.

C. All the data, including the incident key will be deleted, and the context data will be completely empty.

D. No difference, the automation cannot be executed manually.

A. reputation-script

B. enrich

C. reputation

D. reputationScript

A. Data Collection task

B. Conditional task

C. Section Header task

D. Standard task

A. The integration's source code

B. A summary of each version history

C. A test instance for the content pack

D. The source code of each playbook

A. Both the Classifier and Incident Type will classify incoming incidents.

B. The administrator will receive a notification that there is both a Classifier and Incident Type set for that integration instance.

C. The Classifier will be ignored, and incoming incidents will be classified according to the Incident Type.

D. The Incident Type will be ignored, and incoming incidents will be classified according to the Classifier.