Threat Intelligence And Secops Processes

A Cortex XSOAR administrator is configuring a new threat intelligence feed that provides indicators in STIX 2.1 format. The administrator wants to ensure that the indicators are automatically tagged with a specific source name for easy filtering. Which configuration step is required?

Which TWO actions can be performed on an indicator object in XSOAR to support the lifecycle management of threat data?

Which object in Cortex XSOAR is used to define the specific actions taken when a specific threat type is identified?

A security operations center (SOC) receives a report that a nation-state actor is targeting the organization's industry. The report includes indicators of compromise (IOCs) such as IP addresses, domain names, and file hashes. The SOC manager wants to prioritize the response efforts based on the threat actor's known tactics, techniques, and procedures (TTPs). Which framework should the SOC use to map the observed TTPs to a standardized knowledge base for prioritization?

When configuring threat intelligence feeds in Cortex XSOAR, which TWO of the following are key settings that must be configured for the feed to function correctly?

A SOC manager is designing a new threat intelligence process using Cortex XSOAR. The manager wants to ensure that threat intelligence is effectively operationalized within the SOC. Which two of the following are key benefits of integrating threat intelligence feeds with Cortex XSOAR? (Choose two.)

A SOC analyst in Cortex XSOAR is triaging a malware alert and wants to know whether the file hash has been seen in previous incidents within the organization. Which feature should the analyst use to quickly see the reputation, associated incidents, and related indicators for that hash?

Which THREE of the following represent common challenges in SecOps threat intelligence integration that XSOAR helps address?

A security analyst is using the Structured Threat Information Expression (STIX) format to share threat intelligence with a partner organization. The analyst wants to include a relationship between an indicator and a malware object. Which STIX Domain Object (SDO) should the analyst use to represent this relationship?

A security analyst is investigating a phishing incident in Cortex XSOAR. The analyst needs to determine the reputation of a suspicious domain found in the email. Which Cortex XSOAR feature provides this information by querying multiple threat intelligence sources?

A security operations team is using Cortex XSOAR to manage threat intelligence. They receive a large number of indicators from various feeds, and analysts are overwhelmed by the volume. The team wants to prioritize indicators that are most relevant to their organization's threat landscape. Which Cortex XSOAR feature should they use to automatically assign a score to indicators based on multiple factors such as source reliability, indicator type, and age?

A security operations center (SOC) wants to automatically block IP addresses that are identified as malicious by a high-confidence threat intelligence feed. They are using Cortex XSOAR and a Palo Alto Networks Next-Generation Firewall. Which Cortex XSOAR feature should they use to automate the blocking action?

You need to automate the enrichment of IP addresses during incident investigation. Which component in XSOAR facilitates this process?

A security operations team is using Cortex XSOAR to manage threat intelligence. They want to ensure that indicators from a newly added feed are automatically tagged with a specific source name and that their reputation is set to 'Suspicious' by default. Which configuration should the team apply in Cortex XSOAR?

Which TWO of the following are primary objectives of a post-incident review (PIR) using XSOAR reports?

A security analyst receives a threat intelligence report indicating that a specific IP address is associated with a command-and-control (C2) server. The analyst wants to automatically block this IP on the Palo Alto Networks firewall when it is detected in future incidents. Which Cortex XSOAR feature should the analyst use to ensure the IP is automatically blocked?

You are performing a 'threat hunt' and identify a new malicious domain. How do you add this to your blocklist and ensure it persists for future investigations?

What is the role of a 'Classification' in the context of XSOAR incident management?

A SOC analyst is reviewing a threat intelligence report that contains a list of IP addresses associated with a known botnet. The analyst wants to quickly determine which of these IPs have been observed in the organization's network logs. Which type of threat intelligence is most directly used for this purpose?

Which feature in XSOAR allows you to see the relationships between various indicators, incidents, and threat actors?

An analyst is reviewing an incident in Cortex XSOAR that contains an IP indicator. They want to automatically enrich this indicator with geolocation and reputation data from a third-party service during playbook execution. Which Cortex XSOAR component is specifically designed to perform this enrichment?

A security operations center (SOC) wants to measure the effectiveness of their threat intelligence program. They need a metric that reflects how many of the indicators ingested from feeds were actually used in detecting or responding to incidents within Cortex XSOAR. Which Cortex XSOAR feature provides this information?

Which THREE of the following are critical elements of the Indicator Lifecycle in Cortex XSOAR?

Which TWO of the following are valid ways to ingest threat intelligence data into Cortex XSOAR?

A security analyst is reviewing a playbook in Cortex XSOAR that automatically enriches IP addresses. The playbook uses the 'ip' command to query multiple threat intelligence integrations. The analyst wants to ensure that the playbook continues to execute even if one of the integrations fails to respond. Which playbook task configuration should be adjusted?

A security analyst is troubleshooting an integration that is failing to pull data from a threat feed. What is the first place they should check for errors?

A SecOps analyst is investigating a phishing incident in Cortex XSOAR. The incident includes an email with a malicious attachment. The analyst wants to automatically extract and enrich all indicators from the attachment and then block them on the firewall. Which Cortex XSOAR component should the analyst use to orchestrate this workflow?

When creating a custom dashboard in Cortex XSOAR to track threat intelligence trends, which widget type should you use to visualize the distribution of indicator types over time?

Which metric in Cortex XSOAR is most effective for measuring the operational efficiency of the Incident Response team over a fiscal quarter?

What is the benefit of using 'Incident Tags' in the SecOps process?

A security analyst is investigating a phishing incident and wants to determine if the sender's IP address has been associated with any known malicious campaigns. Which threat intelligence platform feature should the analyst use to quickly obtain this context?

During a malware investigation in Cortex XSOAR, an analyst sees that an indicator's reputation has been automatically downgraded from 'Bad' to 'Suspicious' even though no analyst modified it. The indicator was originally ingested from a trusted threat feed. Which mechanism most likely caused this change?

In the context of SecOps processes, which TWO of the following are benefits of using automated playbooks for threat intelligence?

Why should you use an 'Indicator Reputation' threshold in your SecOps process?

What is the primary function of the 'Indicator Extraction' process in Cortex XSOAR?

A security operations center (SOC) uses Cortex XSOAR to manage incidents. An analyst notices that a particular threat intelligence feed is generating a high number of false positive indicators, causing unnecessary incident creation. The analyst wants to reduce noise without losing valuable intelligence from that feed. What is the most appropriate action?

A security analyst notices that a new threat intelligence feed is sending indicators with a 'confidence' field set to 'Low' for most entries. The team wants to ensure that only high-confidence indicators trigger automated blocking actions on the firewall. Which of the following is the most appropriate action to achieve this?

A security analyst is reviewing a threat intelligence report that includes indicators of compromise (IOCs) such as IP addresses and domain names. The analyst wants to import these IOCs into Cortex XSOAR for future correlation with security events. Which Cortex XSOAR component is specifically designed to ingest and manage external threat intelligence feeds?

A security operations team wants to proactively search for threats using indicators of compromise (IOCs) that are not yet linked to any incident. They plan to use threat intelligence data to hunt for these IOCs across their environment. Which approach best describes this activity?

A large volume of duplicate indicators is flooding your XSOAR instance from multiple sources. What is the most efficient way to manage this?

A security operations center (SOC) uses Cortex XSOAR to manage incidents. They want to measure the effectiveness of their threat intelligence sources by tracking how many incidents are generated from each source and the average time to resolution. Which Cortex XSOAR feature should they use to collect and visualize this data?

Which THREE components are part of the standard XSOAR incident layout customization?

A security analyst is investigating a potential data exfiltration incident. The analyst has identified a suspicious IP address communicating with an internal server. To determine if this IP is associated with known malicious activity, the analyst queries a threat intelligence platform. The platform returns a confidence score of 85% and tags the IP as 'C2'. However, the analyst notices that the IP belongs to a cloud hosting provider and could be legitimate. What should the analyst do next to validate the threat intelligence?