XSOAR-Engineer Threat Intelligence Management — Timed 10 Questions

Question 1

A security analyst notices that indicators fetched from a specific OSINT feed are overriding higher-confidence internal indicators. Where should the administrator configure indicator scoring rules to resolve this?

10 minute time limit — choose an answer to begin.

Accepted Answer

Settings > Advanced > Indicator Scoring. Indicator scoring rules in Cortex XSOAR are configured under Settings > Advanced > Indicator Scoring. This section allows administrators to define how indicators are scored based on source reliability, confidence, and other factors, resolving conflicts like OSINT feeds overriding internal indicators. Adjusting these rules ensures that higher-confidence internal indicators take precedence.

Answer

Settings > Object Fields > Indicators

Answer

Settings > Integrations > Instances

Answer

Settings > Advanced > Indicator Types

Question 2

An administrator needs to run a query in the Threat Intel workspace to find all active IP indicators with a 'Bad' reputation associated with a specific campaign tag. Which search syntax is correct?

Accepted Answer

type:IP and reputation:Bad and tag:CampaignX. The Threat Intel workspace in Cortex XSOAR uses a Lucene-style query syntax where fields are referenced as field:value and combined with boolean operators like AND. The correct syntax 'type:IP and reputation:Bad and tag:CampaignX' matches indicator type, reputation, and tag fields exactly as stored in the indicator database. This is the documented format for searching indicators in the Threat Intel module.

Answer

indicator.type == 'IP' & rep == 3

Answer

find ip where status = bad and campaign = CampaignX

Answer

ip = malicious AND tag == CampaignX

Question 3

An organization wants to expire indicators automatically if they have not been seen in any incoming feeds for 90 days. Where is this expiration threshold configured?

Accepted Answer

Settings > Advanced > Indicator Types. Indicator expiration rules are managed globally or per indicator type under Advanced settings in Cortex XSOAR.

Answer

Automation > Scripts > Expiration Script

Answer

Threat Intel > Indicator Queries > Expiration

Answer

Settings > About > Server Configuration

Question 4

An analyst wants to bulk update the tags of 500 indicators selected from a Threat Intel query result. Which feature should be used?

Accepted Answer

Select the indicators in the Threat Intel grid and click the 'Tag' bulk action button.. Cortex XSOAR provides bulk action capabilities in the Threat Intel workspace to tag, untag, or modify indicator reputations.

Answer

Create a scheduled job in Settings > Advanced > Jobs.

Answer

Export indicators to CSV, modify the tags in Excel, and re-import as incidents.

Answer

Run a Python script using demisto.executeCommand() for each indicator ID individually.

Question 5

Where can an administrator view the status and execution logs of scheduled threat feed fetches in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Instances > [Instance Name] > Log. Integration instance logs and execution status can be tracked in the Log/History view of the specific integration instance.

Answer

Threat Intel > Feeds > Status Dashboard

Answer

Incidents > Audit > Feeds

Answer

Automation > Playbooks > Execution History

Question 6

An enterprise requires that all threat indicators ingested from external feeds be automatically enriched via VirusTotal before being marked as active. Where should this workflow logic be configured?

Accepted Answer

Settings > Advanced > Indicator Types > [Type] > Auto-enrichment Playbook. Enrichment playbooks can be linked directly to indicator types or feed ingestion pipelines to automatically run enrichment tasks upon creation.

Answer

Settings > Integrations > Instances > Enrichment Settings

Answer

Incidents > Classification & Mapping > Indicator Rules

Answer

Threat Intel > Feeds > Automation Rules

Question 7

An enterprise uses Cortex XSOAR to synchronize indicators to multiple firewall enforcement points. A feed pushes indicators with a custom attribute. How can the administrator ensure this custom attribute is included in the exported TAXII/STIX bundle?

Accepted Answer

By configuring the indicator mapping in the export integration instance settings.. Custom indicator fields must be mapped within the feed or export integration mapping settings to be included in STIX/TAXII export bundles.

Answer

By adding the attribute to the incident layout editor.

Answer

By modifying the server configuration key 'vim.export.custom.fields'.

Answer

By writing a post-processing automation script that directly injects XML tags into the firewall API.

Question 8

An administrator wants to ensure that threat indicators received from a low-reputation feed do not automatically alter overall incident severities. Where is indicator-to-incident impact configured?

Accepted Answer

Settings > Advanced > Indicator Scoring & Severity Mapping. In Cortex XSOAR, the mapping between indicator reputation/severity and incident severity is configured under Settings > Advanced > Indicator Scoring & Severity Mapping. This section lets administrators define how an indicator's reputation (e.g., Bad, Suspicious, Good) translates into an incident severity (e.g., High, Medium, Low). By adjusting these mappings, an admin can prevent a low-reputation feed from automatically escalating incident severity. This is the central place where indicator-to-incident impact is controlled, not within individual feed settings or incident types.

Answer

Threat Intel > Feeds > Impact Settings

Answer

Incidents > Types > Severity Rules

Answer

Automation > Scripts > SeverityCalculator

Question 9

An analyst needs to quickly check whether an MD5 file hash exists across all active threat intel feeds without navigating through multiple menus. Where can this be performed?

Accepted Answer

The global search bar at the top of the Cortex XSOAR interface.. The global search bar at the top of the Cortex XSOAR interface is the correct answer because it provides a unified, cross-dataset search capability that includes threat intel indicators from all active feeds. When an analyst enters an MD5 hash into this bar, XSOAR queries the threat intel database (which aggregates indicators from all enabled feeds) and returns any matching indicators, along with their associated reputation, source feeds, and related incidents. This eliminates the need to navigate through multiple menus or manually query each feed individually, directly addressing the requirement for a quick, centralized check.

Answer

Automation > Playground > Test Hash

Answer

Settings > Integrations > Global Search

Answer

Incidents > Filter > Hash Lookup

Question 10

An analyst wants to generate a report summarizing all critical indicators ingested over the past week tagged with 'APT29'. Where can this report be created and scheduled?

Accepted Answer

Reports > New Report with a Threat Intel query and scheduled frequency. Reports in Cortex XSOAR can be created in the Reports section and configured with queries targeting threat intel indicators.

Answer

Dashboards > Widgets > Export PDF

Answer

Threat Intel > Reports > New Report

Answer

Settings > Advanced > Scheduled Reports