Exam XSOAR-Engineer Topic 3 Question 12 Discussion

Actual exam question for Palo Alto Networks's XSOAR-Engineer exam
Question #: 12
Topic #: 3
What aggregates data from incidents and indicators into a Cortex XSOAR report?.

Suggested Answer: A Vote an answer

In Cortex XSOAR,Reportsare constructed fromWidgets, which are modular visualization components that pull data from incidents, indicators, tasks, lists, and other system sources. The Admin Guide clarifies that widgets serve as the building blocks for dashboards and reports. When creating a report, users select widgets-such as pie charts, tables, statistics blocks, histograms, and custom scripts-and XSOAR aggregates the underlying data (incidents, indicators, evidence, etc.) into the report output.
Automations (option B) may generate data, but they do not perform the aggregation within a report. SQL queries (option C) are not used natively in XSOAR reporting; instead, widgets may embed queries through the platform's data model. Playbooks (option D) execute response workflows and can generate additional context but are not used for aggregating report data.
Thus, the report-generation process relies entirely on widgets to extract, sort, count, and visualize information.
XSOAR renders the report by collecting the aggregated values produced by each widget. This makes optionA the correct and documented answer.

by Martina at Aug 02, 2026, 11:54 PM

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

0
0
0
10