XSOAR-Engineer Threat Intelligence Management — Timed 15 Questions

Question 1

A security analyst notices that indicators fetched from a specific OSINT feed are overriding higher-confidence internal indicators. Where should the administrator configure indicator scoring rules to resolve this?

15 minute time limit — choose an answer to begin.

Accepted Answer

Settings > Advanced > Indicator Scoring. Indicator scoring rules in Cortex XSOAR are configured under Settings > Advanced > Indicator Scoring. This section allows administrators to define how indicators are scored based on source reliability, confidence, and other factors, resolving conflicts like OSINT feeds overriding internal indicators. Adjusting these rules ensures that higher-confidence internal indicators take precedence.

Answer

Settings > Object Fields > Indicators

Answer

Settings > Integrations > Instances

Answer

Settings > Advanced > Indicator Types

Question 2

An administrator needs to run a query in the Threat Intel workspace to find all active IP indicators with a 'Bad' reputation associated with a specific campaign tag. Which search syntax is correct?

Accepted Answer

type:IP and reputation:Bad and tag:CampaignX. The Threat Intel workspace in Cortex XSOAR uses a Lucene-style query syntax where fields are referenced as field:value and combined with boolean operators like AND. The correct syntax 'type:IP and reputation:Bad and tag:CampaignX' matches indicator type, reputation, and tag fields exactly as stored in the indicator database. This is the documented format for searching indicators in the Threat Intel module.

Answer

indicator.type == 'IP' & rep == 3

Answer

find ip where status = bad and campaign = CampaignX

Answer

ip = malicious AND tag == CampaignX

Question 3

An organization wants to expire indicators automatically if they have not been seen in any incoming feeds for 90 days. Where is this expiration threshold configured?

Accepted Answer

Settings > Advanced > Indicator Types. Indicator expiration rules are managed globally or per indicator type under Advanced settings in Cortex XSOAR.

Answer

Automation > Scripts > Expiration Script

Answer

Threat Intel > Indicator Queries > Expiration

Answer

Settings > About > Server Configuration

Question 4

An analyst wants to bulk update the tags of 500 indicators selected from a Threat Intel query result. Which feature should be used?

Accepted Answer

Select the indicators in the Threat Intel grid and click the 'Tag' bulk action button.. Cortex XSOAR provides bulk action capabilities in the Threat Intel workspace to tag, untag, or modify indicator reputations.

Answer

Create a scheduled job in Settings > Advanced > Jobs.

Answer

Export indicators to CSV, modify the tags in Excel, and re-import as incidents.

Answer

Run a Python script using demisto.executeCommand() for each indicator ID individually.

Question 5

Where can an administrator view the status and execution logs of scheduled threat feed fetches in Cortex XSOAR?

Accepted Answer

Settings > Integrations > Instances > [Instance Name] > Log. Integration instance logs and execution status can be tracked in the Log/History view of the specific integration instance.

Answer

Threat Intel > Feeds > Status Dashboard

Answer

Incidents > Audit > Feeds

Answer

Automation > Playbooks > Execution History

Question 6

An enterprise requires that all threat indicators ingested from external feeds be automatically enriched via VirusTotal before being marked as active. Where should this workflow logic be configured?

Accepted Answer

Settings > Advanced > Indicator Types > [Type] > Auto-enrichment Playbook. Enrichment playbooks can be linked directly to indicator types or feed ingestion pipelines to automatically run enrichment tasks upon creation.

Answer

Settings > Integrations > Instances > Enrichment Settings

Answer

Incidents > Classification & Mapping > Indicator Rules

Answer

Threat Intel > Feeds > Automation Rules

Question 7

An enterprise uses Cortex XSOAR to synchronize indicators to multiple firewall enforcement points. A feed pushes indicators with a custom attribute. How can the administrator ensure this custom attribute is included in the exported TAXII/STIX bundle?

Accepted Answer

By configuring the indicator mapping in the export integration instance settings.. Custom indicator fields must be mapped within the feed or export integration mapping settings to be included in STIX/TAXII export bundles.

Answer

By adding the attribute to the incident layout editor.

Answer

By modifying the server configuration key 'vim.export.custom.fields'.

Answer

By writing a post-processing automation script that directly injects XML tags into the firewall API.

Question 8

An administrator wants to ensure that threat indicators received from a low-reputation feed do not automatically alter overall incident severities. Where is indicator-to-incident impact configured?

Accepted Answer

Settings > Advanced > Indicator Scoring & Severity Mapping. In Cortex XSOAR, the mapping between indicator reputation/severity and incident severity is configured under Settings > Advanced > Indicator Scoring & Severity Mapping. This section lets administrators define how an indicator's reputation (e.g., Bad, Suspicious, Good) translates into an incident severity (e.g., High, Medium, Low). By adjusting these mappings, an admin can prevent a low-reputation feed from automatically escalating incident severity. This is the central place where indicator-to-incident impact is controlled, not within individual feed settings or incident types.

Answer

Threat Intel > Feeds > Impact Settings

Answer

Incidents > Types > Severity Rules

Answer

Automation > Scripts > SeverityCalculator

Question 9

An analyst needs to quickly check whether an MD5 file hash exists across all active threat intel feeds without navigating through multiple menus. Where can this be performed?

Accepted Answer

The global search bar at the top of the Cortex XSOAR interface.. The global search bar at the top of the Cortex XSOAR interface is the correct answer because it provides a unified, cross-dataset search capability that includes threat intel indicators from all active feeds. When an analyst enters an MD5 hash into this bar, XSOAR queries the threat intel database (which aggregates indicators from all enabled feeds) and returns any matching indicators, along with their associated reputation, source feeds, and related incidents. This eliminates the need to navigate through multiple menus or manually query each feed individually, directly addressing the requirement for a quick, centralized check.

Answer

Automation > Playground > Test Hash

Answer

Settings > Integrations > Global Search

Answer

Incidents > Filter > Hash Lookup

Question 10

An analyst wants to generate a report summarizing all critical indicators ingested over the past week tagged with 'APT29'. Where can this report be created and scheduled?

Accepted Answer

Reports > New Report with a Threat Intel query and scheduled frequency. Reports in Cortex XSOAR can be created in the Reports section and configured with queries targeting threat intel indicators.

Answer

Dashboards > Widgets > Export PDF

Answer

Threat Intel > Reports > New Report

Answer

Settings > Advanced > Scheduled Reports

Question 11

A custom threat intelligence feed integration is returning timeout errors during large data fetches. Which integration parameter should the administrator adjust to handle large payloads?

Accepted Answer

Timeout parameter in the integration instance configuration. Integration instances include timeout parameters to control how long the platform waits for HTTP responses from external feed providers.

Answer

Fetch interval frequency

Answer

Indicator expiration threshold

Answer

Server configuration key 'http.lethal.timeout'

Question 12

When writing a custom Python integration for a threat feed, which Demisto/XSOAR command is used to ingest fetched indicators into the platform database?

Accepted Answer

demisto.createIndicators(indicators). In the Demisto/XSOAR Python SDK, 'demisto.createIndicators(indicators)' is the dedicated method for bulk-ingesting indicators into the platform's indicator database. It accepts a list of indicator dictionaries (value, type, reputation, etc.) and writes them through the indicators API, which handles deduplication and enrichment. This is the standard call used in threat feed integrations.

Answer

demisto.incidents().create()

Answer

demisto.executeCommand('add-indicator', args)

Answer

demisto.setIndicatorReputation(values)

Question 13

Which TWO attributes are mandatory when defining a custom indicator type in Cortex XSOAR? Choose 2 answers.

Accepted Answer

Indicator Type Name. When defining a custom indicator type in Cortex XSOAR, the Indicator Type Name (option A) is mandatory because it is the unique identifier used to reference the type throughout the system, including in indicator fields, layouts, and playbooks. The Validation regex or pattern (option C) is also required, as it defines the format that indicator values must match to be recognized and stored as that type, enabling automatic extraction and validation. Options B, D, and E are unrelated to indicator type configuration: Active Directory SSL certificates pertain to authentication integration, syslog facility levels relate to log forwarding, and incident SLA escalation timers are part of incident management settings, not indicator type definitions.

Answer

Active Directory SSL certificate

Answer

Syslog facility level

Answer

Incident SLA escalation timer

Question 14

A threat intel engineer is troubleshooting a custom feed integration in Cortex XSOAR. Indicators fetched from the feed are visible in the war room under the fetch command results, but they never appear on the Threat Intel page. The integration's fetch-indicators command returns a list of indicator objects. Which configuration step is most likely missing?

Accepted Answer

The fetch-indicators command must return indicators using the demisto.command createIndicators with the indicator objects in the response entry context.. For a custom feed integration, fetched indicators are not automatically persisted just because they appear in the command results. The integration must call the createIndicators command with the indicator objects so Cortex XSOAR writes them to the Threat Intel database. Without that explicit ingestion step, indicators remain only in the war room output and never populate the Threat Intel page.

Answer

The integration must be configured with a TAXII collection URL so the platform can pull indicators directly.

Answer

The indicator types returned by the feed must first be registered in the Indicators Types settings page before they can be stored.

Answer

The integration instance's indicator reputation settings must map each indicator type to a reputation level.

Question 15

A Cortex XSOAR engineer is configuring a new feed integration that ingests indicators from a commercial vendor. The vendor's API returns a 'confidence' integer from 0 to 100 for each indicator, and the security team wants indicators with confidence below 40 to be ingested but automatically given a Benign reputation instead of Suspicious or Bad. Which configuration approach in the feed integration instance settings accomplishes this requirement with the least custom code?

Accepted Answer

Use a pre-processing script or mapper with conditional logic that evaluates the confidence field and sets the indicator reputation to Benign when confidence is below 40.. Feed integrations in Cortex XSOAR apply mappers and optional pre-processing scripts to each indicator as it is ingested. Embedding conditional logic there allows the confidence field to drive reputation per indicator, so low-confidence entries become Benign while others keep their normal score, achieving the requirement declaratively rather than through scheduled remediation or blunt feed-wide settings.

Answer

Set the Feed Reputation parameter to Benign and use the feed's indicator type mapping to filter out high-confidence indicators.

Answer

Create a post-processing script that runs on a scheduled job to downgrade the reputation of any indicator whose confidence attribute is below 40.

Answer

Configure the feed's fetch query to exclude indicators with confidence below 40 so they are never ingested into the Threat Intel database.