XSOAR-Engineer Threat Intelligence Management — 40 Questions

Question 1

A security analyst notices that indicators fetched from a specific OSINT feed are overriding higher-confidence internal indicators. Where should the administrator configure indicator scoring rules to resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Settings > Advanced > Indicator Scoring. Indicator scoring rules in Cortex XSOAR are configured under Settings > Advanced > Indicator Scoring. This section allows administrators to define how indicators are scored based on source reliability, confidence, and other factors, resolving conflicts like OSINT feeds overriding internal indicators. Adjusting these rules ensures that higher-confidence internal indicators take precedence.

Answer

Settings > Object Fields > Indicators

Answer

Settings > Integrations > Instances

Answer

Settings > Advanced > Indicator Types

Question 2

An administrator needs to run a query in the Threat Intel workspace to find all active IP indicators with a 'Bad' reputation associated with a specific campaign tag. Which search syntax is correct?

Accepted Answer

type:IP and reputation:Bad and tag:CampaignX. The Threat Intel workspace in Cortex XSOAR uses a Lucene-style query syntax where fields are referenced as field:value and combined with boolean operators like AND. The correct syntax 'type:IP and reputation:Bad and tag:CampaignX' matches indicator type, reputation, and tag fields exactly as stored in the indicator database. This is the documented format for searching indicators in the Threat Intel module.

Answer

indicator.type == 'IP' & rep == 3

Answer

find ip where status = bad and campaign = CampaignX

Answer

ip = malicious AND tag == CampaignX

Question 3

An organization wants to expire indicators automatically if they have not been seen in any incoming feeds for 90 days. Where is this expiration threshold configured?

Accepted Answer

Settings > Advanced > Indicator Types. Indicator expiration rules are managed globally or per indicator type under Advanced settings in Cortex XSOAR.

Answer

Automation > Scripts > Expiration Script

Answer

Threat Intel > Indicator Queries > Expiration

Answer

Settings > About > Server Configuration

Question 4

An analyst wants to bulk update the tags of 500 indicators selected from a Threat Intel query result. Which feature should be used?

Accepted Answer

Select the indicators in the Threat Intel grid and click the 'Tag' bulk action button.. Cortex XSOAR provides bulk action capabilities in the Threat Intel workspace to tag, untag, or modify indicator reputations.

Answer

Create a scheduled job in Settings > Advanced > Jobs.

Answer

Export indicators to CSV, modify the tags in Excel, and re-import as incidents.

Answer

Run a Python script using demisto.executeCommand() for each indicator ID individually.

Question 5

Where can an administrator view the status and execution logs of scheduled threat feed fetches in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Instances > [Instance Name] > Log. Integration instance logs and execution status can be tracked in the Log/History view of the specific integration instance.

Answer

Threat Intel > Feeds > Status Dashboard

Answer

Incidents > Audit > Feeds

Answer

Automation > Playbooks > Execution History

Question 6

An enterprise requires that all threat indicators ingested from external feeds be automatically enriched via VirusTotal before being marked as active. Where should this workflow logic be configured?

Accepted Answer

Settings > Advanced > Indicator Types > [Type] > Auto-enrichment Playbook. Enrichment playbooks can be linked directly to indicator types or feed ingestion pipelines to automatically run enrichment tasks upon creation.

Answer

Settings > Integrations > Instances > Enrichment Settings

Answer

Incidents > Classification & Mapping > Indicator Rules

Answer

Threat Intel > Feeds > Automation Rules

Question 7

An enterprise uses Cortex XSOAR to synchronize indicators to multiple firewall enforcement points. A feed pushes indicators with a custom attribute. How can the administrator ensure this custom attribute is included in the exported TAXII/STIX bundle?

Accepted Answer

By configuring the indicator mapping in the export integration instance settings.. Custom indicator fields must be mapped within the feed or export integration mapping settings to be included in STIX/TAXII export bundles.

Answer

By adding the attribute to the incident layout editor.

Answer

By modifying the server configuration key 'vim.export.custom.fields'.

Answer

By writing a post-processing automation script that directly injects XML tags into the firewall API.

Question 8

An administrator wants to ensure that threat indicators received from a low-reputation feed do not automatically alter overall incident severities. Where is indicator-to-incident impact configured?

Accepted Answer

Settings > Advanced > Indicator Scoring & Severity Mapping. In Cortex XSOAR, the mapping between indicator reputation/severity and incident severity is configured under Settings > Advanced > Indicator Scoring & Severity Mapping. This section lets administrators define how an indicator's reputation (e.g., Bad, Suspicious, Good) translates into an incident severity (e.g., High, Medium, Low). By adjusting these mappings, an admin can prevent a low-reputation feed from automatically escalating incident severity. This is the central place where indicator-to-incident impact is controlled, not within individual feed settings or incident types.

Answer

Threat Intel > Feeds > Impact Settings

Answer

Incidents > Types > Severity Rules

Answer

Automation > Scripts > SeverityCalculator

Question 9

An analyst needs to quickly check whether an MD5 file hash exists across all active threat intel feeds without navigating through multiple menus. Where can this be performed?

Accepted Answer

The global search bar at the top of the Cortex XSOAR interface.. The global search bar at the top of the Cortex XSOAR interface is the correct answer because it provides a unified, cross-dataset search capability that includes threat intel indicators from all active feeds. When an analyst enters an MD5 hash into this bar, XSOAR queries the threat intel database (which aggregates indicators from all enabled feeds) and returns any matching indicators, along with their associated reputation, source feeds, and related incidents. This eliminates the need to navigate through multiple menus or manually query each feed individually, directly addressing the requirement for a quick, centralized check.

Answer

Automation > Playground > Test Hash

Answer

Settings > Integrations > Global Search

Answer

Incidents > Filter > Hash Lookup

Question 10

An analyst wants to generate a report summarizing all critical indicators ingested over the past week tagged with 'APT29'. Where can this report be created and scheduled?

Accepted Answer

Reports > New Report with a Threat Intel query and scheduled frequency. Reports in Cortex XSOAR can be created in the Reports section and configured with queries targeting threat intel indicators.

Answer

Dashboards > Widgets > Export PDF

Answer

Threat Intel > Reports > New Report

Answer

Settings > Advanced > Scheduled Reports

Question 11

A custom threat intelligence feed integration is returning timeout errors during large data fetches. Which integration parameter should the administrator adjust to handle large payloads?

Accepted Answer

Timeout parameter in the integration instance configuration. Integration instances include timeout parameters to control how long the platform waits for HTTP responses from external feed providers.

Answer

Fetch interval frequency

Answer

Indicator expiration threshold

Answer

Server configuration key 'http.lethal.timeout'

Question 12

When writing a custom Python integration for a threat feed, which Demisto/XSOAR command is used to ingest fetched indicators into the platform database?

Accepted Answer

demisto.createIndicators(indicators). In the Demisto/XSOAR Python SDK, 'demisto.createIndicators(indicators)' is the dedicated method for bulk-ingesting indicators into the platform's indicator database. It accepts a list of indicator dictionaries (value, type, reputation, etc.) and writes them through the indicators API, which handles deduplication and enrichment. This is the standard call used in threat feed integrations.

Answer

demisto.incidents().create()

Answer

demisto.executeCommand('add-indicator', args)

Answer

demisto.setIndicatorReputation(values)

Question 13

Which TWO attributes are mandatory when defining a custom indicator type in Cortex XSOAR? Choose 2 answers.

Accepted Answer

Indicator Type Name. When defining a custom indicator type in Cortex XSOAR, the Indicator Type Name (option A) is mandatory because it is the unique identifier used to reference the type throughout the system, including in indicator fields, layouts, and playbooks. The Validation regex or pattern (option C) is also required, as it defines the format that indicator values must match to be recognized and stored as that type, enabling automatic extraction and validation. Options B, D, and E are unrelated to indicator type configuration: Active Directory SSL certificates pertain to authentication integration, syslog facility levels relate to log forwarding, and incident SLA escalation timers are part of incident management settings, not indicator type definitions.

Answer

Active Directory SSL certificate

Answer

Syslog facility level

Answer

Incident SLA escalation timer

Question 14

A threat intel engineer is troubleshooting a custom feed integration in Cortex XSOAR. Indicators fetched from the feed are visible in the war room under the fetch command results, but they never appear on the Threat Intel page. The integration's fetch-indicators command returns a list of indicator objects. Which configuration step is most likely missing?

Accepted Answer

The fetch-indicators command must return indicators using the demisto.command createIndicators with the indicator objects in the response entry context.. For a custom feed integration, fetched indicators are not automatically persisted just because they appear in the command results. The integration must call the createIndicators command with the indicator objects so Cortex XSOAR writes them to the Threat Intel database. Without that explicit ingestion step, indicators remain only in the war room output and never populate the Threat Intel page.

Answer

The integration must be configured with a TAXII collection URL so the platform can pull indicators directly.

Answer

The indicator types returned by the feed must first be registered in the Indicators Types settings page before they can be stored.

Answer

The integration instance's indicator reputation settings must map each indicator type to a reputation level.

Question 15

A Cortex XSOAR engineer is configuring a new feed integration that ingests indicators from a commercial vendor. The vendor's API returns a 'confidence' integer from 0 to 100 for each indicator, and the security team wants indicators with confidence below 40 to be ingested but automatically given a Benign reputation instead of Suspicious or Bad. Which configuration approach in the feed integration instance settings accomplishes this requirement with the least custom code?

Accepted Answer

Use a pre-processing script or mapper with conditional logic that evaluates the confidence field and sets the indicator reputation to Benign when confidence is below 40.. Feed integrations in Cortex XSOAR apply mappers and optional pre-processing scripts to each indicator as it is ingested. Embedding conditional logic there allows the confidence field to drive reputation per indicator, so low-confidence entries become Benign while others keep their normal score, achieving the requirement declaratively rather than through scheduled remediation or blunt feed-wide settings.

Answer

Set the Feed Reputation parameter to Benign and use the feed's indicator type mapping to filter out high-confidence indicators.

Answer

Create a post-processing script that runs on a scheduled job to downgrade the reputation of any indicator whose confidence attribute is below 40.

Answer

Configure the feed's fetch query to exclude indicators with confidence below 40 so they are never ingested into the Threat Intel database.

Question 16

A threat intelligence analyst at a SOC notices that a specific IP address (203.0.113.45) is being reported by an internal honeypot feed as 'benign' because the honeypot only logs connections, not malicious behavior. However, an external premium feed reports the same IP as 'malicious' with high confidence. The analyst wants Cortex XSOAR to automatically resolve this conflict by prioritizing the external feed's reputation over the internal honeypot feed. What should the analyst configure to achieve this?

Accepted Answer

Configure the 'Feed Reliability' for the external feed as 'A - Completely Reliable' and for the honeypot feed as 'F - Not Reliable'.. Feed Reliability is the built-in mechanism in Cortex XSOAR for resolving conflicting indicator reputations. When multiple feeds report different scores, the feed with the highest reliability (A being the highest) determines the final indicator score. This ensures that more trusted sources take precedence without manual intervention. Configuring reliability is a one-time setup that persists across feed updates.

Answer

Adjust the 'Reputation' weight of the external feed in the feed's integration settings to be higher than the honeypot feed.

Answer

Create a playbook that triggers on indicator updates and uses the 'setIndicator' command to force the score to malicious.

Answer

Set the indicator's manual score to 'Malicious' in the Indicator Details page.

Question 17

A Cortex XSOAR engineer needs to add a new reputation command so that analysts can enrich a custom 'DeviceID' indicator type from the CLI and from playbook tasks. The command should accept a list of DeviceID values and return a DBotScore for each. Which XML file must be edited to register this new command and its arguments in the integration?

Accepted Answer

The integration's *.yml file, adding a new command under 'script.commands' with arguments and outputs defined.. Command registration in Cortex XSOAR happens in the integration's YAML definition, specifically under script.commands, where the command name, arguments, and outputs are declared. The Python code implements behavior, but the YAML declaration is what makes the command discoverable in the CLI and playbook editor. Defining arguments and the DBotScore output there ensures the new DeviceID reputation command works end to end.

Answer

The integration's *.yml file, adding a new command block under the 'commands' section.

Answer

The integration's *.py file, adding a new function decorated with @reputation_command.

Answer

The integration's *.json file, adding a new entry to the 'commands' array.

Question 18

A security team wants Cortex XSOAR to automatically create a new incident whenever a threat feed indicator that is already in the Threat Intel database is later seen in a newly ingested indicator from a different feed, so analysts can review the overlap. Which built-in mechanism should the engineer configure to achieve this?

Accepted Answer

A threat intel management rule with a 'Detect' action that triggers when an indicator matches and creates an incident.. Threat intel management rules are the native Cortex XSOAR feature for acting on ingested indicators. A rule with a detect action evaluates conditions such as an indicator matching an existing entry and can automatically create an incident for analyst review. Scheduling, playbook triggers, and lists do not by themselves generate incidents from cross-feed indicator overlap, so the management rule is the right configuration.

Answer

A Cortex XSOAR list named 'overlap_indicators' populated by a custom script that compares feeds on a cron job.

Answer

A playbook trigger configured on the 'Indicator' incident type that runs whenever any indicator is updated.

Answer

A threat intel feed's 'Fetch indicators' schedule, set to run every minute so overlaps are detected quickly.

Question 19

An engineer is configuring a new TAXII 2.1 feed integration in Cortex XSOAR and wants indicators fetched from the collection to be written directly into the Threat Intel database with the feed's own reputation applied, without any manual review step. Which integration parameter must be enabled to achieve this behavior?

Accepted Answer

Enable the 'Create indicators' parameter on the feed integration instance.. Feed integrations in Cortex XSOAR separate the act of retrieving data from the act of persisting indicators. The 'Create indicators' instance parameter is the toggle that writes fetched objects into the Threat Intel database with the feed's reputation, which is exactly what the scenario requires. Fetching and certificate settings affect connectivity and scheduling, while reputation influences scoring rather than persistence.

Answer

Set the feed's 'Fetch indicators' parameter to true and increase the fetch interval.

Answer

Enable 'Trust any certificate (not secure)' in the integration instance settings.

Answer

Set the feed's 'Reputation' parameter to 'Good' so the indicators are trusted by default.

Question 20

A Cortex XSOAR engineer is asked to reduce noise in the Threat Intel database. Several feed integrations are ingesting indicators that overlap with ones already present from higher-fidelity sources, and the team wants to ensure that when two feeds report the same indicator, the more trusted feed's reputation prevails. Which TWO configuration capabilities in Cortex XSOAR help control how conflicting indicator reputations from multiple feeds are resolved? (Choose two.)

Accepted Answer

Leveraging indicator source reliability settings, where each feed can be assigned a reliability rating that influences how its reputation contributions are weighted during aggregation.. Reputation conflict resolution in Cortex XSOAR depends on how each feed's contributed score is weighted. Assigning a Feed Reputation value that mirrors a source's trust level and applying source reliability ratings both influence how overlapping indicators are scored, so the more trusted feed's assessment carries greater weight in the final aggregated reputation.

Answer

Enabling the TLP:RED sharing designation on the trusted feed so its indicators override all other sources in the database.

Answer

Using the Sources section on the indicator and adjusting the score manually for each conflicting indicator as analysts encounter them.

Answer

Configuring indicator expiration rules per feed so stale indicators from lower-fidelity sources age out faster than those from trusted sources.