XSIAM-Analyst Threat Intelligence Management And ASM — 25 Questions

Question 1

You are writing an XQL query to search for internal network traffic matching threat intelligence indicators that have a reliability rating of 'A' and a minimum severity of 'High'. Which syntax correctly filters the threat intelligence dataset in XSIAM?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dataset = threat_intelligence | filter reliability == "A" and severity >= "High". XSIAM's threat intelligence dataset can be queried using XQL with specific filtering on indicator attributes such as reliability and severity.

Answer

dataset = asm_assets | filter ti_reliability == "A"

Answer

dataset = panw_threat_feed | filter grade == "A"

Answer

dataset = xdr_data | lookup threat_intel on indicator | filter score == "High"

Question 2

An analyst wants to create an automated playbook action that checks the reputation of a suspicious IP address against all active threat intelligence feeds in XSIAM. Which built-in command should be used in the playbook?

Accepted Answer

indicator.reputation.get or equivalent threat intelligence enrichment command. XSIAM playbooks support standard commands for threat intelligence enrichment, such as 'ip' or indicator reputation lookup commands.

Answer

cmd.ping.ip

Answer

xql.query.execute

Answer

asm.asset.scan

Question 3

Which THREE attributes are automatically evaluated and stored for indicators ingested into Cortex XSIAM's Threat Intelligence module? (Choose three)

Accepted Answer

Confidence Score. Inaz ingested indicators are characterized by type, severity, confidence, and source reliability.

Answer

Active Directory group membership list

Answer

Local workstation physical disk serial number

Question 4

An administrator needs to ensure that custom threat intelligence indicators ingested via a CSV file maintain a specific custom severity rating of 'Critical' regardless of external provider scores. How should this be configured in XSIAM?

Accepted Answer

Modify the default severity mapping in the Threat Intelligence settings for the custom CSV integration instance to override incoming scores with 'Critical'. When mapping custom indicator feeds, field mapping rules allow forcing specific severities or overriding incoming scores.

Answer

Edit the global indicator whitelist to elevate matching items to Critical

Answer

Manually update each indicator via the incident management console after ingestion

Answer

Create an XQL alert rule that rewrites the indicator severity field upon ingestion

Question 5

You are troubleshooting an Attack Surface Management (ASM) scan in XSIAM where external IP ranges belonging to a newly acquired subsidiary are not showing up in the asset inventory. What is the most likely reason for this discrepancy?

Accepted Answer

The seed domains or IP ranges for the subsidiary have not been added to the ASM configuration scope. ASM relies on defined organization seed assets and authorized external scopes. If the discovery seed is missing, ASM will not map the assets.

Answer

Threat intelligence feeds have disabled automatic asset correlation by default

Answer

The Log Forwarder agent is not installed on the subsidiary endpoints

Answer

The ingestion service for ASM requires manual CSV asset mapping before discovery runs

Question 6

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

Accepted Answer

Attack Surface Management > Assets. Attack Surface Management features have a dedicated workspace within the XSIAM navigation menu.

Answer

Incident Response > ASM Incidents

Answer

Dashboards > Threat Intelligence > ASM

Answer

Settings > Integrations > ASM Scanner

Question 7

An analyst wants to suppress a specific threat intelligence indicator that has been identified as a false positive across all correlation rules in XSIAM. What is the correct procedure?

Accepted Answer

Add the indicator to an active Indicator Whitelist / Exclusion list within Threat Intelligence settings. False positive indicators can be handled by adding them to an exclusion list or marking them as false positive in the Threat Intelligence module.

Answer

Create an exception rule in the Endpoint Protection policy

Answer

Disable all threat intelligence feeds globally

Answer

Delete the indicator manually from every active incident

Question 8

An XSIAM analyst notices that a high-fidelity threat intelligence indicator is generating low-priority alerts because its default expiration time is set too short. Where can the indicator expiration settings be adjusted?

Accepted Answer

Within the Threat Intelligence module settings under Indicator Management and Expiration rules. Indicator expiration rules and reliability scores are configured in the Threat Intelligence module settings.

Answer

In the XQL Search query parameters using the 'expiration' modifier

Answer

Inside the incident correlation rule builder

Answer

By modifying the local collector agent configuration file on endpoints

Question 9

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

Accepted Answer

To continuously discover and map external, internet-facing assets and potential exposures. ASM focuses on discovering unknown or unmanaged internet-facing assets to reduce organizational risk.

Answer

To ingest external threat feeds and correlate them with internal firewall logs

Answer

To monitor internal workstation performance and CPU usage

Answer

To automate the deployment of security patches on cloud servers

Question 10

An analyst is configuring a new threat intelligence feed in XSIAM to ingest Indicators of Compromise (IoCs). Which integration mechanism should be used to pull indicators natively from an external TAXII 2.1 server?

Accepted Answer

Use the native TAXII 2.1 feed integration instance within Cortex XSIAM Settings. XSIAM supports native TAXII 2.1 feeds using the TAXII feed integration, allowing seamless polling of collections for IOCs.

Answer

Upload a static CSV file export from the TAXII server on a scheduled basis

Answer

Deploy an external syslog collector to forward TAXII feeds to the XSIAM ingestion endpoint

Answer

Configure a custom Script Runner playbook to parse the TAXII JSON payload

Question 11

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

Accepted Answer

IP addresses, domains, URLs, and file hashes. XSIAM supports multiple indicator types including IP addresses, domains, URLs, and file hashes (MD5, SHA256).

Answer

Only network traffic packet captures (PCAP files)

Answer

Only file hashes (SHA256 and MD5)

Answer

Only internal Active Directory user account names

Question 12

What is the purpose of tagging threat intelligence indicators in XSIAM?

Accepted Answer

To categorize and group indicators for targeted hunting and filtering in investigations. Tags allow analysts to categorize, organize, and filter indicators for custom hunting queries and incident investigations.

Answer

To increase the processing speed of the ingestion engine

Answer

To automatically block network traffic without creating alerts

Answer

To encrypt sensitive indicators stored in the database

Question 13

You are configuring correlation rules in XSIAM to trigger an incident when internal telemetry matches indicators from a high-confidence threat feed. How do you ensure that indicators from low-confidence feeds are filtered out of this specific rule?

Accepted Answer

Add a condition in the correlation rule logic requiring indicator source reliability or confidence to meet a specific threshold. Correlation rules can include criteria filtering based on indicator source, confidence, or reliability scores.

Answer

Disable the correlation engine when low-confidence feeds are syncing

Answer

Configure the firewall to drop low-confidence indicators automatically

Answer

Delete all low-confidence indicators from the database daily via XQL delete commands

Question 14

What information does an indicator's 'TLP' (Traffic Light Protocol) designation provide in XSIAM?

Accepted Answer

The sharing and distribution boundaries for the threat intelligence data. TLP defines sharing boundaries and restrictions for sensitive information and threat intelligence.

Answer

The technical severity level of the indicator (Low, Medium, High, Critical)

Answer

The network protocol associated with the indicator (TCP, UDP, HTTP)

Answer

The speed at which the feed is polled by the XSIAM ingestion engine

Question 15

When configuring a Threat Intelligence feed using a custom REST API integration in XSIAM, the API requires a bearer token for authentication that expires every 60 minutes. How should this authentication be managed within the integration instance configuration?

Accepted Answer

Configure the integration instance authentication parameters to support automated OAuth2 token generation and refresh. Custom API integrations in XSIAM support authentication handling, including automatic token retrieval and refresh workflows via integration configuration parameters or underlying Cortex XSOAR content packs.

Answer

Configure the endpoint collector to proxy the authentication header

Answer

Write an external cron job to push a new token via syslog

Answer

Hardcode the static bearer token in the integration field and update it manually hourly

Question 16

An organization wants to integrate a proprietary threat intelligence feed that uses a non-standard JSON format. What tool or method should be used within XSIAM to ingest and parse this feed correctly?

Accepted Answer

Use the Generic Feed integration with custom JSON path mapping. Custom feeds that do not match out-of-the-box integrations can be parsed using custom feed integrations or mapping transformations.

Answer

Rewrite the core XSIAM ingestion engine in Python

Answer

Manually convert the JSON feed into a Windows Event Log format

Answer

Configure an endpoint agent to scrape the JSON URL locally

Question 17

An ASM scan in XSIAM flags an external web server as having an outdated SSL/TLS certificate. Where can an analyst view the detailed finding context and remediation recommendations for this exposed asset?

Accepted Answer

Click on the specific asset within the Attack Surface Management asset inventory to open its risk and finding details pane. ASM asset findings provide detailed context and risk information directly within the asset's detail pane.

Answer

Export all raw asset logs to an external SIEM for inspection

Answer

Check the Endpoint Security alert queue

Answer

Review the firewall traffic logs associated with port 443

Question 18

An ASM discovery run identifies a rogue cloud storage bucket publicly exposed to the internet. How does XSIAM's ASM module typically discover this asset without requiring internal cloud credentials?

Accepted Answer

By analyzing Certificate Transparency (CT) logs, DNS brute-forcing, and external port scanning. ASM utilizes external reconnaissance techniques such as certificate transparency log analysis, DNS enumeration, and banner grabbing.

Answer

By intercepting local DNS queries on corporate endpoints

Answer

By scanning internal Active Directory group policies

Answer

By reading netflow data from core internal switches

Question 19

An analyst is investigating an incident where an internal host communicated with a known malicious domain. To verify when the threat intelligence indicator was first and last seen by XSIAM, where should the analyst look?

Accepted Answer

The indicator's details view within the Threat Intelligence module repository. The Threat Intelligence indicator details page records historical sightings, first seen, and last seen timestamps.

Answer

The local endpoint registry hive on the infected workstation

Answer

The ASM asset discovery log

Answer

The firewall hardware diagnostic logs

Question 20

You are configuring Attack Surface Management in XSIAM to monitor brand infringement and typosquatting domains. Which ASM configuration feature enables this capability?

Accepted Answer

External Domain Monitoring and Typosquatting detection rules based on seed keywords. ASM includes domain monitoring capabilities such as typosquatting and brand exposure detection based on seed organization names.

Answer

Endpoint firewall rule generators

Answer

Active Directory domain trust relationship settings

Answer

XQL threat hunting regex patterns on proxy logs