CCNA Ingestion And Automation Questions

The Broker VM rejects the external API's certificate because its issuing CA is not in the default trust store. Uploading the custom CA bundle through the Broker VM management page adds that root to the trust store, allowing TLS validation to succeed and API log ingestion to proceed.

A webhook integration exposes an HTTP endpoint in Cortex XSOAR that the third-party SIEM pushes POST alerts to, enabling near-real-time ingestion without polling. This satisfies the automated alert ingestion requirement by accepting pushed events directly.

Cortex XDR Automation playbooks support conditional branching and looping tasks. The administrator can inspect the API response status code, and if it equals 429, route to a sleep task that waits a defined interval before looping back to the API call. This pattern implements graceful retry logic without relying on undocumented integration parameters, directly satisfying the requirement to handle rate limits.

The Generic Syslog / CEF Collector parses CEF-formatted syslog from third-party devices, mapping fields into Cortex XDR schema. Enabling it on the Broker VM configuration page satisfies the ingestion requirement for the security device's CEF logs.

Broker VM health, status and log forwarding statistics are surfaced under Settings > Configurations > Data Integration > Broker VM, where each deployed broker's connectivity and forwarding metrics are displayed. This path satisfies the administrator's need to monitor broker operational state directly.

Isolating an endpoint is a built-in Cortex XDR containment action that playbooks invoke automatically, severing network connectivity while preserving the agent channel for further investigation. This satisfies the requirement to execute a response task automatically upon detecting a confirmed threat.

The Office 365 Management Activity API is the vendor-documented method for pulling audit and activity data into Cortex XDR, satisfying the supported-integration constraint. It authenticates to Microsoft 365 and streams unified audit log records, unlike unsupported custom scripts or manual exports.

HTTP forwarding in Cortex XDR sends data as structured JSON over HTTPS to a specified endpoint, and it can include raw event fields. This matches the SIEM's requirement for JSON delivery with raw event data, making it the appropriate destination type for this scenario.

Cortex XDR Automation supports scheduled playbooks that can run scripts on a recurring basis. The playbook can query the Cortex XDR API to count endpoints with the hash within a time window, and if the threshold is exceeded, execute a block action. This is the intended use of automation for such conditional, time-based logic. It leverages the built-in orchestration and API integration.

Account Admin and Security Administrator roles hold the permissions needed to create and manage API keys, configure data integration settings and build automation playbooks within Cortex XDR. Lesser roles cannot modify these tenant-wide integration and automation configurations.

A custom Python Integration executes code inside an isolated Docker container provisioned by the Cortex XSOAR engine, satisfying the requirement to reach the internal legacy database securely without a Marketplace integration. The container isolates dependencies and credentials, so the script runs safely within the tenant's controlled environment.

The Broker VM File Collector is designed to ingest log files from configured paths or mounted shares and forward them to Cortex XDR for parsing. It does not require a full endpoint agent and supports field extraction through the configured parser. This matches the requirement of onboarding a Linux application log file without installing the Cortex XDR agent.

Content Packs bundle pre-built integrations, playbooks, dashboards and automation building blocks, directly satisfying the stem's requirement for the primary function. They are curated, versioned artefacts installed from Marketplace, so analysts gain ready-made detection and response content rather than building integrations or playbooks from scratch.

The Broker VM's CloudTrail collector pulls log objects directly from an S3 bucket via API, so AWS CloudTrail log buckets are natively onboarded without an agent or forwarder. This satisfies the native collection requirement for cloud audit data.

The Cortex XDR public API provides the endpoint /public_api/v1/alerts/get_alerts, which is accessed via POST to retrieve alerts. It accepts filters and pagination parameters in the request body, making it the correct method for periodic alert retrieval by a SIEM. Authentication requires an API key and key ID in the headers.

API key or token authentication passes a static credential in the request header, letting Cortex XSOAR authenticate to third-party REST APIs without interactive user sign-in. This suits automated integration instances where no browser-based identity flow is available.

Incident context stores task outputs as structured key-value pairs that subsequent playbook tasks read and write, enabling data to flow between them. Without this shared context store, each task would run in isolation and downstream automation could not consume upstream results.

The Cortex XDR Data Forwarder streams logs to third-party SIEMs over HTTP/HTTPS, and also supports Syslog for compatible collectors. These protocols satisfy the requirement to forward Cortex XDR logs to an external SIEM without custom integration.

The instance name uniquely identifies each configured integration instance, binding one credential set and parameter combination to a distinct label. This satisfies the scenario's need to run multiple connections to the same third-party feed, each with separate API keys, without configuration collisions.

Configuring the syslog collector instance with a valid SSL/TLS certificate and private key enables encrypted Syslog-over-TLS ingestion on the Broker VM, directly satisfying the stem's TLS encryption requirement. The certificate and key terminate TLS at the collector, so forwarded logs travel encrypted rather than in plaintext.

Cloud Storage integration polls an object store such as an AWS S3 bucket, pulling exported cloud audit logs into Cortex XDR. It satisfies the requirement to ingest cloud audit logs without deploying agents, complementing API-based and native connector methods.

Cortex XDR automation allows an alert-triggered rule to run a playbook. The playbook can create a case, set the assignee to the on-call analyst, and perform other response steps. This directly satisfies the requirement of automatic case creation and assignment when the specific BIOC alert fires, and it leverages the built-in orchestration engine.

An Integration Instance in Cortex XDR Automation represents a configured connection to an external system, such as a threat intelligence platform. It allows playbooks to execute commands against that system, retrieve enrichment data, and incorporate it into the alert. This is the correct component to query external platforms and add results to alerts.

The syslog collector processes incoming messages with a fixed pool of worker threads and a bounded queue. Raising both parameters lets the Broker VM absorb bursts by parsing and buffering more concurrent messages, preventing drops when CPU and memory remain normal.

The Data Integration management interface lets engineers define custom log parsing and mapping rules, translating raw vendor fields into Cortex XDR schema. This normalises ingested logs so they can be queried and correlated by detection rules.

CommandResults objects let the integration return structured outputs that XSOAR maps to context data, plus readable text for the war room. This satisfies the platform's requirement for standardised entry context and error handling, rather than printing raw output or raising unhandled exceptions.

The rule correlates a process (PowerShell) with an outbound network connection to an external IP. Cortex XDR needs agent process execution logs for the script context and network event logs for the destination, so both data sources must be ingested.

Correct. Cortex XDR REST API endpoints authenticate using specific header keys and accept JSON payloads.

The Cortex XDR Agent is installed on endpoints and is responsible for collecting telemetry data such as process execution, network connections, and file operations. It sends this data to the Cortex XDR management console for analysis and detection. This directly fulfills the requirement to ingest endpoint telemetry from Windows endpoints.

The Broker VM needs outbound access to cloud APIs, but the forward proxy blocks direct egress. Setting HTTP_PROXY and HTTPS_PROXY environment variables, or the equivalent Broker VM configuration menu entries, directs its enrichment traffic through the proxy, satisfying the internal-network constraint.

The File Collector on Broker VM is designed to read log files from a local directory, parse them according to configured parsers, and forward the data to Cortex XDR. It supports JSON, XML, and other formats, making it suitable for ingesting third-party EDR logs stored as JSON files. This is the correct component for file-based ingestion.

The Broker VM sits between isolated or restricted data sources and the Cortex XDR cloud, collecting and aggregating logs locally and proxying agent traffic. This satisfies the constraint that some sources cannot directly connect to the cloud.

Multiple Broker VMs behind an external Layer 4 load balancer distribute syslog and network log ingestion across nodes, removing the single point of failure and providing horizontal scaling, which directly satisfies the high availability and load balancing requirement for the ingestion tier.

A Condition (or Decision) block evaluates the sandbox task's verdict output, branching the workflow only when the malicious hash is confirmed. This satisfies the stem's requirement for conditional isolation, since the endpoint-isolation action executes solely on a true verdict, preventing unnecessary containment when analysis returns clean or inconclusive results.

CloudTrail delivers logs to S3, so the Broker VM must read that bucket. An AccessDenied error confirms the supplied IAM identity lacks s3:GetObject or ListBucket permissions, blocking ingestion. Granting the required S3 read permissions to that role or user resolves the failure.

The test-module command is the built-in integration health check. It executes the instance's configured test API call, validating that the server URL, API key, and authentication credentials are correct before the integration is used in playbooks.

S3 ingestion via Broker VM requires the IAM identity to read bucket contents. Missing s3:GetObject or s3:ListBucket causes access-denied failures, so confirming both actions are granted isolates permission problems from network or Broker VM faults.

Kerberos tolerates only five minutes of clock skew between the Broker VM and the Domain Controller; beyond that, ticket validation fails and the AD collector cannot authenticate. Resynchronising the Broker VM's system clock via NTP resolves the 'Kerberos Authentication Failed' error.

The Broker VM HTTP Collector is designed to receive logs via HTTP POST, including JSON payloads from webhooks. It can parse and forward data to Cortex XDR for normalization and correlation. This matches the application's capability and the requirement for field mapping.

Enabling the NetFlow/IPFIX Collector on a Broker VM lets Cortex XDR receive flow exports directly from routers, satisfying the stem's requirement to ingest NetFlow records. The Broker VM terminates the UDP export stream and forwards parsed flows to Cortex XDR, so no agent deployment on routers is needed.

Data forwarding filters live under Settings > Configurations > Data Forwarding, where rules select which alerts reach the SIEM. Defining severity-based rules there forwards only High and Critical alerts, satisfying the requirement to exclude Low and Medium.

API keys for external integrations are generated under Settings > Configurations > Integrations > API Keys, where the administrator creates the API Key and Incident ID pair. This location satisfies the stem's requirement for authenticating scripts against the Cortex XDR API.

XSOAR server logs at /var/log/demisto/server.log and the Server Audit trail record API request handling, playbook execution errors and authentication failures. When a Cortex XDR API query or automation script fails, these reveal whether the fault lies in the integration call, credential permissions or the automation logic itself.

The Cortex XDR get-file command retrieves artefacts from a specific endpoint, so it requires both the agent identifier to target the host and the absolute path of the file to collect. Without either, the integration cannot locate the forensic artefact.

The Broker VM must reach the Cortex XDR tenant over outbound TCP 443 to register and maintain its connection. If that egress path is blocked by firewall or proxy rules, the console status stays Disconnected because the VM cannot establish or sustain the management channel.

The Broker VM can be configured to apply local filtering and aggregation before forwarding logs to Cortex XDR. This means you can drop low-value logs or aggregate repetitive events, significantly reducing WAN traffic. Critical security events can be prioritized and sent, ensuring essential data reaches the cloud while conserving bandwidth. This is the intended feature for bandwidth-constrained remote sites.

Cortex XDR Integrations allow engineers to define custom commands that make external API calls, handle authentication, and parse JSON responses. This is the correct component to query MISP using its API key and to update incident fields with the returned threat intelligence in this scenario.

File quarantine and retrieval executes directly through the Cortex XDR endpoint agent, isolating the malicious file and uploading it for forensic analysis without human intervention. This satisfies the stem's requirement for automated response actions initiated against the agent itself, rather than through network or cloud controls.

Exponential backoff with retry logic directly addresses HTTP 429 by progressively increasing the delay between retries, allowing the external threat intel API's rate-limit window to reset before the next request. This satisfies the stem's requirement to handle rate limiting gracefully within the Cortex XSOAR integration command or playbook task, avoiding immediate repeated failures.

The automation rule supports filtering by alert category, which corresponds to the detection type such as Malware, Exploit, or Credential Theft. Setting the category to Malware ensures the playbook triggers only for that class of alert. This enforces the second condition in the scenario and is a required element.

Syslog over UDP and TCP satisfies the requirement for receiving unencrypted messages, as the Cortex XDR Collector natively supports both transports on port 514. UDP provides connectionless, low-overhead delivery, while TCP guarantees ordered delivery; neither encrypts payloads, matching the stem's plaintext constraint.

Cortex XDR Automation is the built-in orchestration engine that allows security teams to create playbooks and automated workflows triggered by alerts. It can execute response actions like endpoint isolation and integrate with external systems such as ticketing platforms via APIs or pre-built integrations, directly fulfilling the requirement to automatically isolate and create a case.

Correlation rules in Cortex XDR support time windows and grouping by fields like endpoint ID. By setting a 5-minute window and grouping by endpoint ID, the rule ensures both events occur on the same endpoint within that timeframe. This directly meets the requirement and is the correct approach.

The Syslog Collector component on the Broker VM listens for incoming syslog traffic on configured ports and protocols. It then forwards the collected logs to the Cortex XDR management console for ingestion and analysis, directly fulfilling the requirement in this scenario.

Data forwarding rules support severity-based filters, so a rule can target Critical while a second rule targets all other severities by excluding Critical. This cleanly routes Critical alerts to the first destination and everything else to the second, with no overlap or duplication. It satisfies the separation requirement precisely.

Selecting the 'Encrypted' or 'Password' parameter type causes Cortex XSOAR to store the value in its encrypted credential store, masking it in the UI and preventing plaintext exposure in integration configuration, playbooks or logs. This satisfies the requirement for secure credential handling within the integration.

Cortex XDR's Automation module hosts playbooks, which are attached to Incident Trigger rules so they execute automatically when matching incidents are generated. This satisfies the requirement that VirusTotal enrichment run automatically on every new malware incident without manual analyst action.