An administrator wants to run an automation in the War Room to set the incident field "Description" to "Confirmed Phishing". Which command should they enter in the War Room CLI?

• A.!setIncident description="Confirmed Phishing"
• B./setIncident description=Confirmed Phishing
• C.!incidentSet description="Confirmed Phishing"
• D./incidentSet description=Confirmed Phishing

Comment: *

Name: *

Email: *

Verification: *

What is the difference between labels and fields?

• A.Labels are indexed in the database and fields are not
• B.Fields can be used in playbooks and labels cannot
• C.Fields are indexed in the database and labels are not
• D.Labels can be used in queries and fields cannot

Comment: *

Name: *

Email: *

Verification: *

An engineer's organization system is registered in the following manner: <SiteName-SystemID- Username>. The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate 'User' indicator automatically once a system is found.
What is the most efficient way for the engineer to achieve this?

• A.Create a new indicator type of the internal username and set a formatting script to extract only the username
• B.Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning
• C.Change the reputation command for the internal system indicator type
• D.Create a custom indicator field named 'username' and link it to the internal system indicator

Comment: *

Name: *

Email: *

Verification: *

What does Script helper contain?

• A.Available commands
• B.Permission settings
• C.Automation version history
• D.Automation timeout configuration

Comment: *

Name: *

Email: *

Verification: *

Which two components have their own context data? (Choose two.)

• A.Task
• B.Incident
• C.Field
• D.Sub-playbook

Comment: *

Name: *

Email: *

Verification: *