A threat intelligence analyst is configuring a TAXII 2.1 client to collect STIX 2.1 data from a new provider. The provider's collection requires authentication and supports filtering by object type. The analyst wants to ensure that only indicators and observed-data objects are retrieved, and that the client can resume collection after a network interruption without missing data. Which TWO configuration steps are necessary to meet these requirements? (Choose two.)
A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a MISP instance. The analyst notices that the same IP address appears with different timestamps and contextual tags from each feed. Which MISP feature should be used to consolidate these duplicate attributes while preserving the earliest sighting date and merging the tags?
A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a local MISP instance. The analyst notices that many indicators are duplicates but have different timestamps and slightly different metadata. To reduce noise and improve correlation, the analyst wants to merge these duplicates while preserving the most recent information. Which MISP feature should the analyst use?
A threat intelligence analyst is reviewing a newly received STIX 2.1 bundle that contains an Indicator object with a pattern referencing a file hash. The analyst needs to verify the pattern is syntactically correct and can be parsed by the organization's TAXII client. Which of the following should the analyst use to validate the STIX pattern?
A threat intelligence analyst is using MISP to correlate events and notices that two separate events contain the same IP address but with different timestamps. The analyst wants to ensure that the IP address is treated as the same attribute across both events for correlation purposes. Which MISP feature should the analyst use to achieve this?
A CERT is preparing to share a collection of indicators with partner organizations through a TAXII 2.1 server. The indicators include domain names, file hashes, and IPv4 addresses. The team must ensure that the shared content is interoperable and that partners can filter by indicator type. Which two STIX 2.1 practices should the team apply to meet these requirements? (Choose two.)
A threat intelligence analyst is using the OpenIOC framework to encode indicators of compromise. The analyst wants to create an indicator that detects a specific registry key value that is a string containing 'malware' anywhere in the data. Which OpenIOC element and attribute should the analyst use to achieve this?
A threat intelligence analyst is processing a large set of indicators collected from various sources. The analyst needs to ensure that the data is properly normalized before ingestion into a TIP. Which two actions are essential for normalizing indicator data? (Choose two.)
A threat intelligence analyst is collecting data from a new OSINT source that provides indicators in a JSON format. The analyst needs to extract indicators and map them to a STIX 2.1 format for ingestion into a TIP. The JSON contains a field 'ip_address' with values in CIDR notation, such as '192.168.1.0/24'. Which STIX 2.1 object should the analyst use to represent this network indicator?
You are troubleshooting a feed ingestion failure in an OpenCTI platform where the connector logs show '403 Forbidden' during a HTTPS pull. What is the primary troubleshooting step?
When collecting data from open-source intelligence (OSINT) sources, what is the primary risk associated with automated scraping without rate-limit awareness?
You are configuring a TAXII 2.1 feed in a SIEM. You need to ensure that the collection process only retrieves high-confidence indicators. Where is this filter typically applied?
You are using MISP to ingest a feed that provides indicators in CSV format. You need to map the 'src_ip' column to the appropriate MISP attribute type. Which mapping is most accurate for ensuring effective correlation?
Which protocol is most commonly used for the automated transport of machine-readable threat intelligence, specifically designed to support the STIX format?
While processing threat intelligence, you encounter an indicator containing a 'base64' encoded payload. Which action should be performed during normalization to maintain searchability?
You are configuring a TAXII client to pull STIX 2.1 data from a commercial threat intelligence platform. During testing, the client reports a 406 Not Acceptable error. What is the most likely cause?
You are integrating a dark web monitoring feed into your TIP. The data arrives as unstructured text. What is the most effective first step in the data processing pipeline?
You are ingesting threat data into a TIP and notice that indicators lack 'TLP' (Traffic Light Protocol) markings. What is the standard industry procedure?
A security analyst is validating a threat feed that uses JSON. Which tool is most appropriate for verifying that the JSON structure conforms to a specific schema?
A threat intelligence analyst at a financial institution is ingesting a high-volume STIX 2.1 feed from a commercial provider. The feed contains many duplicate and near-duplicate indicators. The analyst needs to programmatically deduplicate the data before storing it in a MISP instance. Which approach is most appropriate for identifying and removing duplicate indicators?
A threat intelligence analyst is processing a large dataset of indicators collected from multiple OSINT sources. The analyst notices that many indicators are malformed, such as IP addresses with invalid octets or domain names containing illegal characters. The analyst needs to ensure that only valid indicators are stored in the intelligence platform. Which action should the analyst take during the processing phase?
An analyst at a financial services firm receives a threat feed where each entry contains a 'confidence' field set to 85. The feed vendor's documentation states that confidence values are expressed as a percentage. The analyst needs to normalize this data before loading it into the internal threat intelligence platform, which accepts confidence on a 0-100 integer scale. Which action should the analyst take during processing?
An analyst is collecting threat intelligence from a new OSINT source that provides indicators in a structured format. The analyst needs to ensure that the data is ingested into the threat intelligence platform (TIP) without manual reformatting. Which data format is most commonly supported by TIPs for automated ingestion?
A threat intelligence analyst is processing a large set of indicators and needs to enrich them with additional context. The analyst wants to use the MITRE ATT&CK framework to map indicators to adversary tactics, techniques, and procedures (TTPs). Which data processing step should be performed first to ensure accurate mapping?
A threat intelligence analyst is processing a new feed that contains indicators of compromise (IOCs) in STIX 2.1 format. Before ingesting the data into the internal platform, the analyst must validate that the STIX objects conform to the specification. Which two of the following are required properties for a STIX 2.1 'Indicator' object? (Choose two.)
A threat intelligence analyst is collecting data from a TAXII 2.1 server. The analyst needs to retrieve only the indicators that have been added or modified since the last collection. Which TAXII 2.1 feature should be used to achieve this?
A threat intelligence analyst is collecting data from a dark web forum to identify emerging threats. The analyst uses a web scraping tool that automatically extracts posts and user metadata. After several hours, the tool is blocked and the analyst's IP is banned. Which of the following is the most likely cause of the block, and what should the analyst have implemented to prevent it?
An analyst is extracting indicators from a large collection of PDF reports. The reports contain IP addresses embedded in narrative text, tables, and footnotes with inconsistent formatting. The analyst needs a repeatable method to extract IPv4 addresses while minimizing false positives from version numbers such as 10.2.3.4. Which approach best supports this requirement?
An analyst is processing a set of indicators received in a CSV file. The file contains a column labeled 'ip_address' with values such as '192.168.1.1' and '10.0.0.1'. The analyst needs to import these into a threat intelligence platform that expects indicators to be classified by type. Which of the following actions should the analyst take to ensure proper classification?
A threat intelligence analyst is processing a set of indicators and needs to ensure that the data is properly enriched and contextualized before dissemination. Which TWO of the following actions are appropriate during the processing phase of the threat intelligence lifecycle? (Choose two.)
A threat intelligence team ingests a daily feed delivered as a single JSON file. Each record includes an indicator value, a confidence score, and a free-text description. During processing, the team must enrich each indicator with internal asset context and geographic location before loading it into a MISP event. Which action should be performed first to ensure the enrichment stage has clean, normalized records?
A threat intelligence analyst is collecting data from a new OSINT source that provides indicators in a proprietary XML format. The analyst needs to extract the indicators and convert them into a structured format for ingestion into the organization's TIP. Which of the following is the most appropriate first step in processing this data?
A threat intelligence analyst is ingesting a large volume of indicators from multiple feeds into a TIP. The analyst notices that many indicators are duplicated across feeds but have slightly different metadata, such as confidence scores and timestamps. To ensure efficient processing and accurate analysis, which of the following should the analyst implement to handle these duplicates?
A threat intelligence analyst is preparing to ingest a new threat feed that provides indicators in STIX 2.1 format. Before ingestion, the analyst must ensure the data is properly structured and can be processed by the TIP. Which of the following are valid steps to prepare the STIX 2.1 data for ingestion? (Choose two.)
A junior analyst receives a CSV export from a partner that contains a column named 'indicator' with values such as 'hxxp://malicious[.]example[.]com/path'. The analyst needs to prepare these values for ingestion into a threat intelligence platform that expects defanged indicators to be normalized. Which action should the analyst take?
A threat intelligence analyst is collecting data from a paste site that frequently removes posts within hours. The analyst wants to preserve the content for later analysis and ensure that the original source can be verified even if the post is deleted. Which collection practice best meets these requirements?
An analyst receives a collection of threat indicators from a partner in a STIX 2.1 bundle. Several indicators use the 'pattern' property with the 'LIKE' comparison operator, such as [file:name LIKE '%.exe']. The analyst needs to filter these indicators to only those that match files with a specific name exactly 'malware.exe'. Which STIX pattern should the analyst use to achieve this?
An analyst is using YARA to create a rule that detects a specific malware family by matching a unique string in memory. The analyst wants the rule to match when the string appears at least three times in the scanned data. Which YARA condition should the analyst use?