Exam XSIAM-Engineer Topic 2 Question 86 Discussion

Both C and D are strong, effective methods for addressing this complex scenario. C: Create Separate Rules: This is a straightforward and effective way to apply different logic based on account type. You create one rule for standard user accounts (with the lower threshold) and another, identical rule but with a higher threshold, specifically targeting identified service accounts. This clearly separates the monitoring logic. D: Leverage Context Tables/Lookup Lists: This is a more elegant and scalable solution, especially if you have many service accounts or different thresholds for various types of service accounts. You maintain a 'Context Table' (also known as a 'Lookup List') in XSIAM that maps service account names to their desired failed login thresholds. The indicator rule's XQL query can then 'join' or "lookup' this table to dynamically apply the correct threshold based on the 'user_name' in the event. This centralizes threshold management and reduces the need for multiple static rules. Option A reduces sensitivity for all accounts, potentially missing user-based brute-force. Option B completely ignores service account issues, which can still be indicators of compromise. Option E is a post-detection automation, not a rule optimization; it still generates the false positive and consumes alert triage time.