Threat Intelligence Management And ASM

An analyst needs to assess the external attack surface of a newly acquired subsidiary whose primary domain is registered under a different parent organization. The analyst plans to configure an Attack Surface Management (ASM) scan in Cortex XSIAM. Which TWO configuration elements must be defined so that ASM can discover external assets associated with this subsidiary? (Choose two.)

An analyst is investigating an incident where an internal host communicated with a known malicious domain. To verify when the threat intelligence indicator was first and last seen by XSIAM, where should the analyst look?

A Cortex XSIAM analyst is investigating an external-facing asset discovered by Attack Surface Management (ASM). The asset appears in the inventory but has no associated service, certificate, or technology details, and the analyst needs to understand what ASM actually observed. Which action should the analyst take to review the raw discovery evidence for this asset?

An analyst is validating that Cortex XSIAM threat intelligence is being applied correctly to internal telemetry. The analyst wants to confirm which internal data sources are being matched against ingested indicators. Which TWO capabilities should the analyst use to verify indicator matches against internal telemetry? (Choose two.)

An analyst is reviewing threat intelligence indicators and notices a specific file hash is marked as 'Expired'. What does this status indicate in XSIAM?

An analyst wants to enrich Cortex XSIAM incidents with context from an external threat intelligence provider so that severity and indicator reputation appear directly on the incident. The provider exposes a REST API keyed by indicator value. Which Cortex XSIAM capability should the analyst use to bring this context into incidents?

Which TWO actions can an analyst perform on a threat intelligence indicator directly from the XSIAM Threat Intelligence workspace? (Choose two)

What information does an indicator's 'TLP' (Traffic Light Protocol) designation provide in XSIAM?

An analyst discovers that a threat intelligence feed is ingesting indicators with expiration dates far in the future, causing stale indicators to remain active. The analyst wants to enforce a maximum indicator lifespan of 30 days from the feed's own 'last_seen' field, regardless of what the source provides. Which setting in the Cortex XSIAM threat intelligence feed integration should be configured to achieve this?

A Cortex XSIAM analyst is validating an incoming TAXII 2.1 threat intelligence feed that keeps returning a 401 Unauthorized error during the 'Test' step of the feed configuration. The feed URL, collection ID, and API root are correct, and the same credentials work in a browser. What should the analyst verify first to resolve the failure?

A Cortex XSIAM analyst receives a threat intelligence indicator for a domain that is used by a business partner. The indicator is marked as malicious by an open-source feed, but the partner confirms the domain is legitimate. The analyst wants to ensure the domain does not trigger future incidents while keeping the feed enabled for other indicators. What should the analyst do?

An analyst is reviewing an ASM finding in Cortex XSIAM that flags an external server as exposing an outdated TLS version. The analyst wants to confirm the exact endpoint, port, and certificate details associated with the finding before escalating to the infrastructure team. Where in Cortex XSIAM should the analyst look to view the detailed evidence for this specific ASM finding?

An analyst notices that a high-severity threat intelligence indicator for a malicious domain is present in the XSIAM indicator repository but is not triggering any correlation rule matches against endpoint telemetry, even though several endpoints have resolved that domain. The indicator's expiration date is in the future and the feed that supplied it is enabled. What is the most likely cause?

An analyst is building a Cortex XSIAM correlation rule that uses a threat intelligence indicator set to tag matched events. They need to control how long an ingested indicator remains active before it stops producing matches, so stale indicators from a feed that stopped publishing new data do not keep generating alerts. Which indicator property should the analyst configure on the feed integration to achieve this?

What is the primary benefit of continuous Attack Surface Management (ASM) monitoring compared to periodic external vulnerability scans?

During an Attack Surface Management (ASM) review, an analyst needs to confirm which external-facing assets belonging to the organization have a specific known-vulnerable service version exposed. Where in Cortex XSIAM should the analyst look to see the discovered assets, their open ports, and detected service versions for the configured external IP ranges?

An analyst notices that a threat intelligence feed integration in Cortex XSIAM has been running for three days, but the Indicators view shows zero new indicators since the initial sync. The integration's health dashboard shows a green status and no error logs. Which action should the analyst take FIRST to determine why indicators are not appearing?

When configuring a Threat Intelligence feed using a custom REST API integration in XSIAM, the API requires a bearer token for authentication that expires every 60 minutes. How should this authentication be managed within the integration instance configuration?

When setting up a threat intelligence feed integration in XSIAM, what is the purpose of the 'Fetch Indicators' toggle?

An organization's security policy requires that any threat intelligence indicator originating from an untrusted open-source feed must not automatically generate high-severity blocking alerts. How can this policy be enforced in XSIAM?

You are configuring Attack Surface Management in XSIAM to monitor brand infringement and typosquatting domains. Which ASM configuration feature enables this capability?

A security analyst is configuring a new external attack surface scan in Cortex XSIAM. The analyst wants to ensure that the scan only targets IP addresses and domains that are explicitly owned by the organization, avoiding any third-party assets. Which configuration step should the analyst take to define the scope of the scan?

An organization wants to configure custom threat intelligence scoring in XSIAM. Which THREE factors can influence the composite threat score of an indicator within the platform? (Choose three)

An analyst needs to ingest a commercial threat intelligence feed into Cortex XSIAM. The feed publishes indicators in a proprietary XML schema that no built-in integration supports, and the vendor provides only a REST endpoint returning that XML. What is the correct approach to make these indicators available in XSIAM?

A threat intelligence analyst in Cortex XSIAM notices that a specific indicator from a feed is causing a high number of false positive alerts in correlation rules. The analyst wants to prevent this indicator from triggering any future alerts without removing it from the threat intelligence database, as it may still be useful for historical context. What is the most appropriate action to take?

An analyst is reviewing a Cortex XSIAM threat intelligence indicator for a malicious domain and wants Cortex XSIAM to automatically expire the indicator after 30 days so that stale data does not trigger future correlation rules. The feed is delivered through a TIM-enabled integration that supports indicator expiration. Which setting should the analyst configure to achieve this?

A Cortex XSIAM analyst is tuning detection logic and needs to reduce noise from a threat intelligence indicator that repeatedly matches benign internal traffic. The analyst wants the indicator to remain available for enrichment but to stop generating detections. Which TWO actions should the analyst take to achieve this goal? (Choose two.)

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

An analyst is configuring a new threat intelligence feed in XSIAM to ingest Indicators of Compromise (IoCs). Which integration mechanism should be used to pull indicators natively from an external TAXII 2.1 server?

An analyst wants to suppress a specific threat intelligence indicator that has been identified as a false positive across all correlation rules in XSIAM. What is the correct procedure?

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

What is the purpose of tagging threat intelligence indicators in XSIAM?

An administrator is setting up Attack Surface Management (ASM) discovery scopes in XSIAM. Which THREE types of seed assets can be provided to initiate external discovery? (Choose three)

An analyst is investigating an ASM finding regarding an exposed service on an external asset. Which THREE details are typically provided within the ASM finding record in XSIAM? (Choose three)

During an Attack Surface Management (ASM) review in Cortex XSIAM, an analyst sees an external-facing asset classified as 'Unregistered' even though the asset's IP address appears in a configured discovery scope. The analyst confirms the IP is reachable and the scan completed successfully. What is the MOST likely explanation for the classification?

A Cortex XSIAM analyst is onboarding a new threat intelligence provider that publishes indicators at a very high rate. Shortly after enabling the feed, the analyst notices that indicator searches are slow and that several other feeds appear to have stopped updating. The platform's resource utilization is elevated. Which action best addresses the root cause while preserving intelligence coverage?

Which TWO methods can an analyst use to investigate matches between internal network telemetry and threat intelligence indicators in XSIAM? (Choose two)

An ASM discovery run identifies a rogue cloud storage bucket publicly exposed to the internet. How does XSIAM's ASM module typically discover this asset without requiring internal cloud credentials?

A Cortex XSIAM analyst wants to review which external IP addresses and domains belong to the organization's internet-facing footprint after an ASM scan completes, so they can validate that no unexpected assets were discovered. Where does the analyst review the inventory of discovered external assets in XSIAM?

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

During an incident investigation, an analyst opens the Cortex XSIAM Threat Intelligence module and searches for an external IP address observed in the alert. The indicator detail view shows a 'Verdict' of 'Unknown' and no associated sources, even though several feed integrations are enabled and healthy. The analyst confirms the IP appears in logs but not in any indicator store. What is the most likely explanation for the missing verdict and sources?

A Cortex XSIAM analyst is preparing to ingest a third-party threat intelligence feed that provides indicators as STIX 2.1 objects. Before enabling the feed, the analyst wants to confirm that the platform can parse the format natively. Which statement best describes Cortex XSIAM's handling of STIX-formatted threat intelligence?

An analyst wants to enrich an incident in Cortex XSIAM by correlating its associated IP addresses against the organization's active threat intelligence feeds. Which TWO actions will produce a list of matching indicators for those IPs? (Choose two.)

A security manager asks an analyst to explain how Cortex XSIAM uses the Threat Intelligence module during alert triage. The analyst wants to describe the primary operational benefit correctly. Which statement best describes its role?

You are configuring correlation rules in XSIAM to trigger an incident when internal telemetry matches indicators from a high-confidence threat feed. How do you ensure that indicators from low-confidence feeds are filtered out of this specific rule?

A Cortex XSIAM analyst is reviewing ASM findings for an external asset that exposes an outdated web framework. The asset is owned by a subsidiary that was acquired last quarter and is not listed in any existing discovery scope. The analyst wants ASM to start monitoring this subsidiary's domains and IP ranges automatically in future scans. What should the analyst do first?

A Cortex XSIAM analyst notices that a threat intelligence feed integration shows a status of 'Disconnected' and no new indicators have appeared in the indicator store for several hours. The feed uses an API key that the vendor recently rotated. What is the most likely cause and the appropriate first action?

A security analyst in Cortex XSIAM wants to enrich incoming alerts with context from an external threat intelligence source. The analyst needs the platform to automatically query the source and attach reputation and related indicators to matching alerts. Which Cortex XSIAM capability should the analyst configure to achieve this enrichment?

A Cortex XSIAM Attack Surface Management scan has discovered an internet-facing server, but its hostname and open ports are recorded while the owning business unit and criticality are blank. The analyst wants subsequent ASM findings on this asset to be routed to the correct team and prioritized correctly. What should the analyst do to enrich the asset with ownership and criticality context?

An analyst has just enabled a new threat intelligence feed in Cortex XSIAM and wants to quickly confirm whether indicators from that feed are actually being stored and are available for investigation, without waiting for a correlation rule to fire. Which action best accomplishes this?

An analyst is reviewing an Attack Surface Management scan that enumerated an external-facing host. The host is flagged with an unauthenticated remote code execution exposure tied to a specific product build, but the analyst needs to prioritize remediation based on whether the exposure is actively being exploited in the wild. Which XSIAM feature should the analyst consult to determine real-world exploitation status for this exposure?

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

An analyst is tuning Cortex XSIAM Attack Surface Management (ASM) after a scan generated a large volume of findings, many of which are expected and low risk. The analyst wants to reduce noise so future scans surface only meaningful exposure. Which TWO actions are appropriate for this goal? (Choose two.)

A Cortex XSIAM analyst is reviewing external attack surface findings and wants to reduce noise from ASM by focusing only on genuinely risky exposures. The analyst plans to use ASM finding attributes to filter and triage. Which TWO attributes are most useful for identifying externally exposed services that represent elevated risk and warrant immediate investigation? (Choose two.)

A Cortex XSIAM administrator notices that an ASM scan completed successfully but a known external web application was not listed in the results. The application is reachable from the internet and is owned by the organization. Which troubleshooting step is most appropriate to determine why the asset was missed?

A Cortex XSIAM analyst is reviewing how threat intelligence indicators flow from an enabled feed into detection. The analyst wants to understand which actions occur when the feed integration polls and new indicators are retrieved. (Choose two.)

A Cortex XSIAM analyst is configuring an Attack Surface Management (ASM) discovery scope for a subsidiary and wants to ensure that only externally reachable assets are included in the inventory, excluding internal-only hosts. Which configuration should the analyst apply to the scope?

A threat intelligence administrator has ingested a feed of domain indicators into Cortex XSIAM. Several of those domains are legitimate business partners, and the administrator wants future correlation and detection logic to ignore them without deleting the indicators or disabling the entire feed. Which XSIAM mechanism should the administrator use?

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

An analyst is triaging an alert in Cortex XSIAM where an internal host contacted an external IP address that appears in multiple threat intelligence feeds. The analyst wants to determine, within the platform, why the indicator is considered malicious and how it relates to known campaigns. Which TWO actions help the analyst understand the indicator's context and provenance? (Choose two.)

An organization wants to integrate a proprietary threat intelligence feed that uses a non-standard JSON format. What tool or method should be used within XSIAM to ingest and parse this feed correctly?

A security manager wants Cortex XSIAM to automatically raise the severity of incidents involving indicators that appear on a specific high-confidence threat intelligence feed, without affecting incidents tied to lower-confidence feeds. Which configuration achieves this requirement?

An analyst is reviewing the results of an Attack Surface Management scan in Cortex XSIAM and sees a finding for an exposed service on a non-standard port. The analyst wants to understand the potential risk and remediation steps. Where can the analyst find detailed information about this finding, including the service banner and recommended actions?

You are troubleshooting an Attack Surface Management (ASM) scan in XSIAM where external IP ranges belonging to a newly acquired subsidiary are not showing up in the asset inventory. What is the most likely reason for this discrepancy?

An ASM scan in XSIAM flags an external web server as having an outdated SSL/TLS certificate. Where can an analyst view the detailed finding context and remediation recommendations for this exposed asset?

A security operations team wants Cortex XSIAM to continuously discover internet-facing assets belonging to their organization without manually supplying individual hostnames each time a new subsidiary is onboarded. Which ASM capability should they configure to achieve ongoing discovery from a broad organizational identifier?

An analyst investigating a phishing alert wants to confirm whether a domain seen in the email headers is associated with known malicious activity. The domain does not appear in any enabled feed. Which Cortex XSIAM capability allows the analyst to check the domain's reputation and enrich the investigation without leaving the platform?