Threat Intelligence Management

An analyst wants to view the historical reputation changes of a specific malicious IP address over time. Which tab within the Indicator Details page provides this timeline?

When configuring a feed integration instance, the administrator selects 'Trust level' as 'Good'. How does this affect the indicator's calculated score when conflicting with a malicious feed?

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

An analyst identifies a false positive indicator that is currently marking legitimate outbound traffic as malicious. What action should the analyst take to neutralize its effect globally in XSOAR?

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

A feed integration is pulling indicators successfully, but the correlation rules are not triggering when new incidents are created with matching observables. What is the most likely cause?

When setting up a new threat intelligence feed, what parameter determines how far back in time the integration pulls historical indicators upon initial run?

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

An analyst wants to manually add a single known malicious domain to the Threat Intel database. Which method is most direct?

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

A scheduled feed is failing with a certificate verification error because the feed source uses an internal self-signed SSL certificate. How can an administrator resolve this in Cortex XSOAR?

Which indicator type should an administrator select when configuring a feed that supplies malicious URL strings?

An organization uses a custom threat feed that updates via an API requiring OAuth2 authentication with token rotation. How should the administrator configure this integration instance?

Where can an administrator view summary metrics regarding total indicators, breakdown by type, and top malicious sources in Cortex XSOAR?

Which TWO factors influence the final calculated reputation score of an indicator when multiple feeds provide conflicting data? Choose 2 answers.

Which THREE parameters are typically required when configuring a generic REST API feed integration instance in Cortex XSOAR? Choose 3 answers.

An analyst observes that an indicator's score is fluctuating between malicious and benign because two different feeds report contradictory reputations. How can the administrator enforce that Feed A always takes precedence over Feed B?

An administrator needs to temporarily disable a noisy threat intelligence feed without losing its configuration settings. What is the correct action?

Which TWO actions can an administrator perform within the Cortex XSOAR Threat Intel workspace when managing indicators? Choose 2 answers.

When troubleshooting a feed integration that fails to parse incoming data, which TWO diagnostic steps should an administrator take? Choose 2 answers.

Which TWO details are typically visible within an individual Indicator Details view in Cortex XSOAR? Choose 2 answers.

Which THREE configuration settings can be applied to manage indicator lifecycles in Cortex XSOAR? Choose 3 answers.

Which TWO advanced configurations are required when setting up a TAXII 2.0/2.1 client feed in Cortex XSOAR? Choose 2 answers.

Which THREE methods can be used to export threat indicators out of Cortex XSOAR to external systems? Choose 3 answers.

Which THREE types of data can be ingested as threat intelligence indicators in Cortex XSOAR out-of-the-box? Choose 3 answers.

Which TWO Cortex XSOAR features assist analysts in investigating indicators found in threat feeds? Choose 2 answers.

Which TWO considerations are critical when planning custom indicator mapping for a non-standard JSON threat feed? Choose 2 answers.

A threat intel analyst at a SOC is reviewing a domain indicator in Cortex XSOAR that has been assigned a score of 3 (Bad). The analyst wants to clearly understand which specific threat feed integration was responsible for assigning that malicious score, so they can evaluate whether the source is trustworthy. Where should the analyst look to determine the origin of the indicator's score in Cortex XSOAR?

A Cortex XSOAR engineer configures a new TAXII 2.1 feed using the TAXII2 Server integration. The feed instance connects successfully, but the engineer notices that indicators already present in the Threat Intel database from other sources are not being linked to the new feed's source. Which setting on the feed instance must be reviewed to ensure existing indicators are associated with this feed's source?

A Cortex XSOAR engineer is using the built-in TAXII2 integration to pull indicators from a partner's server. The partner recently started publishing indicators with the STIX pattern type 'network-traffic' (for IP-and-port combinations), but these objects never appear on the Threat Intel page even though other indicator types from the same collection arrive normally. The feed instance shows a successful fetch with no errors. What is the most likely cause?

An analyst is investigating a phishing incident and wants to determine which threat intelligence sources have reported a specific IP address as malicious. The IP indicator exists in the Threat Intel database. Which action should the analyst take to view the list of sources that contributed to this indicator's reputation?

A security team notices that a domain indicator's reputation score in Cortex XSOAR keeps dropping from Bad to Suspicious, then returning to Bad, even though no analyst has manually changed it. The domain is reported by two feeds: Feed A assigns a Bad reputation, and Feed B assigns a Benign reputation. Both feeds are configured with the same expiration and both run every hour. What is the most likely cause of the fluctuating score?

A security engineer is integrating a new TAXII 2.1 feed into Cortex XSOAR. The feed requires authentication using a client certificate and a private key. After configuring the integration instance with the correct certificate and key, the engineer notices that no indicators are being fetched, and the integration logs show 'SSL certificate verification failed'. The TAXII server uses a self-signed certificate. What should the engineer do to resolve this issue while maintaining security best practices?

A security team wants to ensure that indicators ingested from a newly integrated MISP feed are automatically tagged with a specific label for easier filtering and correlation. Which configuration on the MISP feed instance in Cortex XSOAR allows the engineer to apply a custom tag to all indicators from this feed?

An engineer is building a custom indicator type for 'CryptocurrencyAddress' and wants Cortex XSOAR to automatically extract these values from incident evidence and enrich them. The engineer has created the indicator type and a reputation command. Which additional configuration is required so that the platform automatically identifies CryptocurrencyAddress values in new incidents and runs the reputation command?

A security team wants to share indicators from Cortex XSOAR with an external partner's TAXII 2.1 server and also push indicators to a SIEM via a supported export mechanism. Which TWO Cortex XSOAR capabilities support exporting threat indicators to external systems? (Choose two.)

An engineer is configuring indicator expiration for a threat feed. The organization wants indicators from this feed to expire 30 days after they are last seen in the feed. The engineer sets the 'Expiration' parameter to 30 days on the feed instance. However, after 30 days, indicators are still present in the Threat Intel database. Which factor is most likely preventing the expiration from occurring?

An engineer needs Cortex XSOAR to enrich every newly ingested indicator from an external feed by querying an internal WHOIS service before the indicator is stored, and to block ingestion if enrichment fails. The WHOIS service is exposed through a custom integration. Which approach best meets this requirement?

A Cortex XSOAR engineer is reviewing an incident and wants to see the enrichment details for a specific IP indicator, including which integrations produced scores and when the indicator was last seen. From the incident's indicator list, which action opens the full Indicator Details view for that IP?

A Cortex XSOAR engineer must ensure that indicators from a high-confidence internal feed are never automatically expired by threat intel management rules, even when they have not been seen for a long period. Which configuration achieves this?

An engineer configured a feed integration with the 'Indicator Reputation' parameter set to 'Bad' and 'Expiration' set to 30 days. After a week, analysts report that indicators from this feed still appear in the database long after the feed stopped returning them, and some indicators have a reputation of 'Good' from another source. Which behavior explains why the indicators persist and how reputation is determined?

A junior analyst needs to look up whether a suspicious file hash has been seen in any ingested threat feeds and wants to see the associated feed sources, first-seen date, and current reputation in a single view. Where in Cortex XSOAR should the analyst navigate?

An engineer must design a workflow that exports Cortex XSOAR threat indicators to two external systems: a SIEM that ingests indicators via a REST API, and a partner organization that consumes indicators through a TAXII 2.1 server. Which TWO Cortex XSOAR capabilities should the engineer use to implement these outbound integrations? (Choose two.)

A Cortex XSOAR engineer configures a TAXII 2.1 feed integration and confirms the server connection succeeds, but the Threat Intel page shows no indicators. The collection browser returns STIX 2.1 objects with type 'indicator' and 'observed-data'. The engineer then runs the fetch command manually and sees objects returned in the raw response. Which configuration element most likely prevents the indicators from being created in the Threat Intel database?

A Cortex XSOAR engineer needs to ensure that a specific internal IP range used by the company's vulnerability scanners is never treated as malicious by any feed, even if a public feed later reports one of those IPs as bad. Which TIM mechanism should the engineer configure to guarantee this exclusion?

A Cortex XSOAR engineer is designing a playbook that must enrich an IP indicator with data from a premium TIM feed only when the indicator's current score is Suspicious or Bad. The playbook uses a task that queries the indicator via the TIM API. Which approach ensures the enrichment task runs only for indicators meeting the score condition?