XSOAR-Engineer Threat Intelligence Management — 20 Questions

Question 1

An analyst wants to view the historical reputation changes of a specific malicious IP address over time. Which tab within the Indicator Details page provides this timeline?

Accepted Answer

Timeline or History tab. The Reputation or History tab in the Indicator Details page displays the audit trail of score updates and source contributions.

Answer

Raw Data tab

Answer

Workplan tab

Answer

Related Incidents tab

Question 2

When configuring a feed integration instance, the administrator selects 'Trust level' as 'Good'. How does this affect the indicator's calculated score when conflicting with a malicious feed?

Accepted Answer

It assigns a higher weight to trusted sources, potentially overriding lower-trust malicious feeds.. Trust levels in XSOAR determine how indicator scores from various sources are weighed and resolved during reputation calculation.

Answer

It causes the indicator score to be permanently locked to 0 regardless of other feeds.

Answer

It disables feed fetching for that specific indicator value.

Answer

It automatically deletes the indicator if any other feed reports it as malicious.

Question 3

A security analyst notices that indicators fetched from a specific OSINT feed are overriding higher-confidence internal indicators. Where should the administrator configure indicator scoring rules to resolve this?

Accepted Answer

Settings > Advanced > Indicator Scoring. Indicator scoring rules in Cortex XSOAR allow administrators to assign weights and precedence to different indicator sources to manage conflicts.

Answer

Settings > Object Fields > Indicators

Answer

Settings > Integrations > Instances

Answer

Settings > Advanced > Indicator Types

Question 4

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

Accepted Answer

Generic Feed integration using the GenericFeed module. The Generic Feed integration allows administrators to map custom JSON, CSV, or XML structures to XSOAR indicator fields using JSONPath or regex.

Answer

Standard Syslog integration parser mapping

Answer

Threat Intel Management API endpoint receiver

Answer

Custom REST API automation script executed via timer triggers

Question 5

An administrator needs to run a query in the Threat Intel workspace to find all active IP indicators with a 'Bad' reputation associated with a specific campaign tag. Which search syntax is correct?

Accepted Answer

type:IP and reputation:Bad and tag:CampaignX. XSOAR indicator queries utilize specific syntax such as type:IP and reputation:Bad combined with tag filters.

Answer

indicator.type == 'IP' & rep == 3

Answer

find ip where status = bad and campaign = CampaignX

Answer

ip = malicious AND tag == CampaignX

Question 6

An analyst identifies a false positive indicator that is currently marking legitimate outbound traffic as malicious. What action should the analyst take to neutralize its effect globally in XSOAR?

Accepted Answer

Update the indicator reputation to Benign or False Positive.. Whitelisting or marking an indicator as 'False Positive' or changing its score to 0/Benign updates its reputation across the platform.

Answer

Delete the incident associated with the indicator.

Answer

Export the indicator to a CSV file for manual review.

Answer

Disable the active playbook attached to the threat intel module.

Question 7

An organization wants to expire indicators automatically if they have not been seen in any incoming feeds for 90 days. Where is this expiration threshold configured?

Accepted Answer

Settings > Advanced > Indicator Types. Indicator expiration rules are managed globally or per indicator type under Advanced settings in Cortex XSOAR.

Answer

Automation > Scripts > Expiration Script

Answer

Threat Intel > Indicator Queries > Expiration

Answer

Settings > About > Server Configuration

Question 8

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Accepted Answer

Verify that the fetch indicators setting is enabled on the integration instance configuration.. Feed integration instances in XSOAR rely on enabled fetch indicators settings and valid instance configurations to pull data into the Threat Intel page.

Answer

Restart the entire Cortex XSOAR server container service.

Answer

Disable all pre-built indicator types to avoid parsing conflicts.

Answer

Ensure the default incident classification scheme maps TAXII records to custom layouts.

Question 9

An analyst wants to bulk update the tags of 500 indicators selected from a Threat Intel query result. Which feature should be used?

Accepted Answer

Select the indicators in the Threat Intel grid and click the 'Tag' bulk action button.. Cortex XSOAR provides bulk action capabilities in the Threat Intel workspace to tag, untag, or modify indicator reputations.

Answer

Create a scheduled job in Settings > Advanced > Jobs.

Answer

Export indicators to CSV, modify the tags in Excel, and re-import as incidents.

Answer

Run a Python script using demisto.executeCommand() for each indicator ID individually.

Question 10

A feed integration is pulling indicators successfully, but the correlation rules are not triggering when new incidents are created with matching observables. What is the most likely cause?

Accepted Answer

Indicator matching is disabled globally or the incident type is not configured to correlate indicators.. Indicator matching against incidents requires indicator auto-extract or matching configurations to be active in incident types or server settings.

Answer

Indicators must be manually pushed to the incident war room using a CLI command.

Answer

The XSOAR server license has expired for threat intelligence modules.

Answer

The feed source uses STIX 1.x instead of STIX 2.1 format.

Question 11

Where can an administrator view the status and execution logs of scheduled threat feed fetches in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Instances > [Instance Name] > Log. Integration instance logs and execution status can be tracked in the Log/History view of the specific integration instance.

Answer

Threat Intel > Feeds > Status Dashboard

Answer

Incidents > Audit > Feeds

Answer

Automation > Playbooks > Execution History

Question 12

An enterprise requires that all threat indicators ingested from external feeds be automatically enriched via VirusTotal before being marked as active. Where should this workflow logic be configured?

Accepted Answer

Settings > Advanced > Indicator Types > [Type] > Auto-enrichment Playbook. Enrichment playbooks can be linked directly to indicator types or feed ingestion pipelines to automatically run enrichment tasks upon creation.

Answer

Settings > Integrations > Instances > Enrichment Settings

Answer

Incidents > Classification & Mapping > Indicator Rules

Answer

Threat Intel > Feeds > Automation Rules

Question 13

When setting up a new threat intelligence feed, what parameter determines how far back in time the integration pulls historical indicators upon initial run?

Accepted Answer

Lookback period or First fetch parameter. Feed integration instances typically include a 'First fetch' configuration parameter to determine historical data retrieval depth.

Answer

Fetch Interval frequency

Answer

Maximum Indicator Limit

Answer

Indicator Expiration Timer

Question 14

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

Accepted Answer

It automatically normalizes and merges indicator entries based on type-specific normalization rules.. XSOAR normalizes indicator values based on indicator type definitions to prevent duplicates from casing or minor formatting differences.

Answer

It rejects the second feed entirely if a similar string exists.

Answer

It creates separate indicator records for every variation to preserve raw feed data.

Answer

It requires a manual merge action via the Threat Intel UI for every duplicate.

Question 15

An enterprise uses Cortex XSOAR to synchronize indicators to multiple firewall enforcement points. A feed pushes indicators with a custom attribute. How can the administrator ensure this custom attribute is included in the exported TAXII/STIX bundle?

Accepted Answer

By configuring the indicator mapping in the export integration instance settings.. Custom indicator fields must be mapped within the feed or export integration mapping settings to be included in STIX/TAXII export bundles.

Answer

By adding the attribute to the incident layout editor.

Answer

By modifying the server configuration key 'vim.export.custom.fields'.

Answer

By writing a post-processing automation script that directly injects XML tags into the firewall API.

Question 16

An analyst wants to manually add a single known malicious domain to the Threat Intel database. Which method is most direct?

Accepted Answer

Navigate to Threat Intel > Indicators > New Indicator.. Indicators can be created manually directly from the Threat Intel workspace using the 'New Indicator' button.

Answer

Modify the server configuration file via SSH.

Answer

Create a dummy incident and run a War Room command.

Answer

Import a full STIX 2.1 bundle via API.

Question 17

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

Accepted Answer

The STIX/TAXII server configuration mapping rules for outgoing indicator properties.. TAXII server export configurations require defining which indicator fields and custom tags to include in the outgoing STIX collection mapping.

Answer

The server-wide proxy exception list.

Answer

The global incident layout settings.

Answer

The SIEM parser configuration for incoming Syslog messages.

Question 18

A scheduled feed is failing with a certificate verification error because the feed source uses an internal self-signed SSL certificate. How can an administrator resolve this in Cortex XSOAR?

Accepted Answer

Disable SSL verification in the integration instance configuration parameters if the option is available, or add the CA certificate to the trust store.. Custom or self-signed certificates must be added to the XSOAR server trust store or the integration instance must have certificate validation disabled if supported.

Answer

Delete the integration instance and recreate it using HTTP instead of HTTPS.

Answer

Increase the timeout threshold in server configuration.

Answer

Modify the feed provider's web server configuration.

Question 19

Which indicator type should an administrator select when configuring a feed that supplies malicious URL strings?

Accepted Answer

URL. Cortex XSOAR includes predefined indicator types such as URL, IP, Domain, and File Hash.

Answer

IP

Answer

File Hash

Answer

Domain

Question 20

An administrator wants to ensure that threat indicators received from a low-reputation feed do not automatically alter overall incident severities. Where is indicator-to-incident impact configured?

Accepted Answer

Settings > Advanced > Indicator Scoring & Severity Mapping. Indicator impact on incident severity can be configured or tuned within Advanced settings or indicator scoring configurations.

Answer

Threat Intel > Feeds > Impact Settings

Answer

Incidents > Types > Severity Rules

Answer

Automation > Scripts > SeverityCalculator