Threat Intelligence Management And ASM

An analyst is investigating an incident where an internal host communicated with a known malicious domain. To verify when the threat intelligence indicator was first and last seen by XSIAM, where should the analyst look?

An analyst is reviewing threat intelligence indicators and notices a specific file hash is marked as 'Expired'. What does this status indicate in XSIAM?

When managing threat intelligence feeds in XSIAM, which THREE options are available for configuring feed synchronization intervals? (Choose three)

When reviewing Attack Surface Management (ASM) scan results in XSIAM, an administrator can classify discovered assets using various status designations. Which THREE statuses are standard asset classifications in ASM? (Choose three)

Which TWO actions can an analyst perform on a threat intelligence indicator directly from the XSIAM Threat Intelligence workspace? (Choose two)

What information does an indicator's 'TLP' (Traffic Light Protocol) designation provide in XSIAM?

What is the primary benefit of continuous Attack Surface Management (ASM) monitoring compared to periodic external vulnerability scans?

When configuring a Threat Intelligence feed using a custom REST API integration in XSIAM, the API requires a bearer token for authentication that expires every 60 minutes. How should this authentication be managed within the integration instance configuration?

When setting up a threat intelligence feed integration in XSIAM, what is the purpose of the 'Fetch Indicators' toggle?

An organization's security policy requires that any threat intelligence indicator originating from an untrusted open-source feed must not automatically generate high-severity blocking alerts. How can this policy be enforced in XSIAM?

You are configuring Attack Surface Management in XSIAM to monitor brand infringement and typosquatting domains. Which ASM configuration feature enables this capability?

An organization wants to configure custom threat intelligence scoring in XSIAM. Which THREE factors can influence the composite threat score of an indicator within the platform? (Choose three)

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

An analyst is configuring a new threat intelligence feed in XSIAM to ingest Indicators of Compromise (IoCs). Which integration mechanism should be used to pull indicators natively from an external TAXII 2.1 server?

An analyst wants to suppress a specific threat intelligence indicator that has been identified as a false positive across all correlation rules in XSIAM. What is the correct procedure?

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

What is the purpose of tagging threat intelligence indicators in XSIAM?

An administrator needs to ensure that custom threat intelligence indicators ingested via a CSV file maintain a specific custom severity rating of 'Critical' regardless of external provider scores. How should this be configured in XSIAM?

An administrator is setting up Attack Surface Management (ASM) discovery scopes in XSIAM. Which THREE types of seed assets can be provided to initiate external discovery? (Choose three)

An analyst is investigating an ASM finding regarding an exposed service on an external asset. Which THREE details are typically provided within the ASM finding record in XSIAM? (Choose three)

Which TWO methods can an analyst use to investigate matches between internal network telemetry and threat intelligence indicators in XSIAM? (Choose two)

An ASM discovery run identifies a rogue cloud storage bucket publicly exposed to the internet. How does XSIAM's ASM module typically discover this asset without requiring internal cloud credentials?

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

You are configuring correlation rules in XSIAM to trigger an incident when internal telemetry matches indicators from a high-confidence threat feed. How do you ensure that indicators from low-confidence feeds are filtered out of this specific rule?

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

An organization wants to integrate a proprietary threat intelligence feed that uses a non-standard JSON format. What tool or method should be used within XSIAM to ingest and parse this feed correctly?

An XSIAM analyst notices that a high-fidelity threat intelligence indicator is generating low-priority alerts because its default expiration time is set too short. Where can the indicator expiration settings be adjusted?

You are troubleshooting an Attack Surface Management (ASM) scan in XSIAM where external IP ranges belonging to a newly acquired subsidiary are not showing up in the asset inventory. What is the most likely reason for this discrepancy?

An ASM scan in XSIAM flags an external web server as having an outdated SSL/TLS certificate. Where can an analyst view the detailed finding context and remediation recommendations for this exposed asset?