Free Practice Questions for Paloalto Networks XSOAR-Engineer Exam

The XSOAR Incident State Model defines several system statuses: Pending, Active, In-Progress, Done, and Closed. When an incident is newly created and has not yet had a playbook assigned or started—and no analyst actions (such as commands or work plan steps) have been taken—it remains in the Pending state.

Pending indicates that the incident exists in the system but has not yet begun active investigation or automated processing. The Admin Guide clarifies that an incident becomes Active only when a playbook starts or an analyst interacts with it. In-Progress is a manually applied user state indicating active human processing. Waiting is used for blocked or paused tasks but does not apply at initial creation.

Because the War Room is available but unused, and no automation has begun, the incident fits the definition of Pending exactly. Once a playbook were attached or a command were executed, the state would transition to Active.

Therefore, the documented correct answer is B: Pending.

The XSOAR Incident Relationships model provides multiple ways to connect related incidents for correlation and hierarchical investigation. The Admin Guide details howRelate Incidentscreates a logical link between two or more incidents, identifying them as connected without altering their internal data. This is commonly used when incidents share a common threat, indicator, or root cause.

Join Incidentsallows analysts to group multiple incidents under a single parent investigation while keeping them technically separate. Joined incidents appear together in correlation views and analytics dashboards, enabling SOC teams to assess broader attack patterns. Joining does not merge content or overwrite fields; it simply binds multiple incidents under a shared investigative umbrella.

“Add Child Incidents” (option B) is used for parent–child hierarchical workflows, not grouping related violations. “Merge Incidents” (option D) consolidates multiple incidents into one and deletes the originals, which is not the intended function for grouping related but distinct events.