During an investigation of an alert with a completed playbook, it is determined that no indicators exist from the email "indicator@test.com" in the Key Assets & Artifacts tab of the parent incident. Which command will determine if Cortex XSIAM has been configured to extract indicators as expected?

!checkIndicatorExtraction text="indicator@test.com"

Question 3 - Palo Alto Networks XSIAM Analyst Exam Questions [May 2026 Update]

Q: 3

During an investigation of an alert with a completed playbook, it is determined that no indicators exist from the email "[email protected]" in the Key Assets & Artifacts tab of the parent incident. Which command will determine if Cortex XSIAM has been configured to extract indicators as expected?

Options

Correct Answer:

Explanation

The !checkIndicatorExtraction command is a built-in diagnostic tool in Cortex XSIAM designed specifically to test the indicator extraction logic. An analyst can use this command in the War Room to input a string of text, such as "[email protected]". The command then simulates the extraction process based on the system's current configuration, including regular expressions and exclusion lists. The output shows whether the provided text would be identified and extracted as an indicator, thereby helping to determine if the configuration is working as expected or if a misconfiguration is preventing automatic extraction.

Why Incorrect

A. !createNewIndicator manually creates a new indicator; it does not test or diagnose the automated extraction configuration.

B. !extractIndicators manually forces the extraction of indicators from a given text, bypassing the automated process rather than testing it.

D. !email is an enrichment command used to get reputation information about an email address; it does not check the extraction process.

References

1. Palo Alto Networks, Cortex XSOAR Administrator's Guide: "You can test indicator extraction using the checkIndicatorExtraction command in the War Room. This command shows you which indicators are extracted from the text you provide." (This principle and command functionality are inherited by Cortex XSIAM from its XSOAR foundation). Reference: Cortex XSOAR 6.8 Administrator's Guide, "Indicator Extraction Troubleshooting" section.

2. Palo Alto Networks, Cortex XSOAR Built-in Commands Reference: The documentation for built-in commands explicitly defines the purpose of !checkIndicatorExtraction as a tool for validating the extraction process, distinguishing it from action-oriented commands like !createNewIndicator (manual creation) and !extractIndicators (manual extraction). Reference: Cortex XSOAR documentation, "Built-in Commands" section.

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE