CCNA Threat Intelligence Management And ASM Questions

ASM discovery relies on explicitly defined scopes that tell the scanner which external domains, IP ranges, or CIDRs to enumerate. Including the subsidiary's root domain and its known subdomains ensures ASM expands coverage to all related external assets, even when the parent organization's registration differs. Without this scope, those assets remain invisible to the scan.

The Threat Intelligence module's indicator details view records the first-seen and last-seen timestamps for each indicator, directly satisfying the requirement to establish when XSIAM observed the malicious domain. This repository view aggregates sightings across ingested sources, giving the analyst the precise observation window rather than raw log timestamps.

The asset details page in ASM aggregates the discovery evidence, including observed services, certificates, technologies, and scan findings tied to that asset. Reviewing it gives the analyst the raw context of what the scan actually detected, which is exactly what is needed when the inventory summary looks incomplete. This is the correct path to inspect discovery evidence.

XQL search in Cortex XSIAM lets analysts query the underlying datasets directly, so filtering events by a specific indicator value confirms whether internal telemetry contains matches. This method is precise and auditable because it operates on raw data rather than summarized views. It complements indicator detail views by showing the exact events, timestamps, and source datasets involved in the match.

Expired means the indicator's configured time-to-live or retention window elapsed without a feed refresh, so XSIAM no longer treats it as active for matching. It reflects staleness of the source data, not a false-positive verdict.

Cortex XSIAM threat intelligence feed integrations ingest indicators from external providers and, when enrichment is enabled, attach reputation and related context to matching indicators and the incidents that reference them. This is the native mechanism for pulling REST-based provider data into the platform and surfacing it on incidents. Configuring the feed with the provider's API credentials and enabling enrichment directly satisfies the analyst's goal of showing provider context on incidents.

Adding an indicator to an exclusion or allow list is available directly from the Threat Intelligence workspace, letting analysts suppress matching activity without leaving the console. This satisfies the stem's requirement for actions performed on an indicator in place, alongside tagging or expiry changes, rather than requiring a separate policy editor.

TLP markings — RED, AMBER, GREEN, CLEAR — define who may receive and further distribute the intelligence. The designation therefore sets the sharing and distribution boundaries governing that indicator's handling, exactly the constraint the question asks about.

This setting directly controls how indicator expiration is calculated. By choosing the last_seen-based method and setting the interval to 30 days, XSIAM will automatically expire indicators 30 days after their last_seen timestamp, overriding any longer expiration provided by the source. This ensures indicators are removed when they become stale, aligning with the analyst's requirement.

TAXII 2.1 enforces authentication on each HTTP request, and XSIAM stores the credential in the integration instance. A 401 specifically means the server rejected the credential presented, not that the collection or URL is broken. Verifying the username/API key or Bearer token in the instance settings is the correct first step because the browser session may have used a different auth method than the integration.

An allow list in the Threat Intelligence module tells XSIAM to treat the specified indicator as benign during enrichment and correlation. This prevents the legitimate partner domain from generating future incidents while leaving the feed enabled and other indicators active. It is the targeted control the analyst needs for a confirmed false positive without disrupting broader intelligence ingestion.

ASM findings in Cortex XSIAM are surfaced in the Attack Surface Management interface, where each finding links to the affected asset and the specific issue. Opening the finding shows the endpoint, port, TLS version, and certificate details collected during the scan. This is the authoritative location for validating ASM evidence before escalation.

Correlation rules in XSIAM match telemetry against indicators only when the indicator's reputation meets the rule's configured threshold and the indicator type aligns with the field being evaluated. A future expiration and an enabled feed confirm the indicator is live, so the mismatch is in reputation scoring or type-to-field mapping, which prevents the rule from ever evaluating a match.

The TTL (time-to-live) or expiration property on a threat intelligence feed integration defines how long each ingested indicator stays valid before XSIAM stops using it in correlation. Setting this value ensures indicators from a feed that has gone quiet age out automatically, preventing stale indicators from continuously matching internal telemetry and generating false alerts.

Continuous ASM discovers internet-facing assets on an ongoing basis, surfacing newly exposed services, shadow IT, and perimeter changes as they appear. Periodic scans only capture point-in-time snapshots, so they miss exposures introduced between scan cycles.

ASM in XSIAM maintains an inventory of discovered external assets along with observed attributes like open ports, detected services, and versions. Reviewing this view for the configured external IP ranges is the correct way to identify assets exposing a specific vulnerable service version, since the discovery data is surfaced there after scans complete.

A healthy integration that fetched once but stopped can indicate that the 'Fetch indicators' toggle was disabled after the initial run, or that a short indicator expiration (TTL) is causing newly fetched indicators to expire before the analyst queries them. Reviewing these settings directly addresses the scenario's symptom of zero new indicators with a green status.

OAuth2 token generation and refresh lets the integration instance obtain a new bearer token automatically before the 60-minute expiry, avoiding manual token rotation. This satisfies the short-lived credential constraint without analyst intervention or failed feed fetches.

The toggle governs scheduled polling: when enabled, XSIAM queries the source's API at the configured interval and ingests returned indicators. Disabling it stops indicator retrieval entirely, so it controls active collection rather than parsing, deduplication, or indicator expiry.

Reliability ratings propagate to indicators, and correlation rules can exclude low-reliability feeds from high-severity alert generation. Setting the untrusted feed to Low, or filtering on that attribute, prevents its indicators from triggering blocking alerts, satisfying the policy constraint.

External Domain Monitoring with typosquatting detection rules uses seed keywords to generate and watch look-alike domains, alerting on brand impersonation attempts. This is the ASM capability purpose-built for the brand infringement and typosquatting monitoring the scenario requires.

Attack Surface Management scans require a defined scope to know which assets to assess. Uploading a CSV with owned IP ranges and domains explicitly limits the scan to those assets. This prevents scanning third-party or unknown assets, which could be unauthorized. This is the correct method to define scope.

Custom severity mapping overrides directly adjust an indicator's severity weighting, which feeds the composite threat score calculation in XSIAM. This satisfies the stem's requirement for a configurable scoring factor, since analysts can remap vendor-specific severity values to platform-defined levels, altering how each indicator contributes to the final aggregated score.

When no built-in integration supports a proprietary schema, the supported path is a custom integration or parser that pulls from the REST endpoint and maps the vendor's XML into XSIAM's expected indicator structure. This preserves automated fetching and updates rather than relying on manual imports. It is the standard extensibility approach for non-standard feeds and ensures indicators flow into the indicator store for enrichment and correlation.

Indicator exclusion rules allow analysts to specify indicators that should be ignored by correlation rules. By setting the rule to exclude from correlation, the indicator remains in the database for historical reference but will not trigger new alerts. This directly addresses the requirement without deleting the indicator.

The TTL setting controls how long an indicator remains active before Cortex XSIAM automatically expires it. Configuring a 30-day TTL on the indicator or its feed ensures the malicious domain is retired from active correlation after that period, preventing stale threat intelligence from generating false alerts. This is the intended mechanism for time-bounded indicator retention.

Many correlation rules match indicators based on reputation or severity thresholds. Lowering the indicator's reputation or severity so it no longer qualifies as malicious prevents those rules from firing, while the indicator remains present for enrichment. This achieves noise reduction without deleting the indicator from the store.

IP addresses, domains, URLs, and file hashes are the standard indicator types the Threat Intelligence module ingests, satisfying the stem's requirement for supported indicator categories. Each maps to a distinct Cortex XSIAM indicator object used for matching against ingested logs and alerts during detection.

The native TAXII 2.1 feed integration instance in Cortex XSIAM Settings directly satisfies the requirement to pull indicators from an external TAXII 2.1 server. It implements the TAXII 2.1 protocol natively, handling collection discovery, polling intervals and STIX 2.1 object parsing without custom scripting or intermediary brokers.

Adding the indicator to an active Indicator Whitelist or Exclusion list in Threat Intelligence settings prevents it from triggering any correlation rule, suppressing the false positive globally. This satisfies the requirement to suppress across all rules without disabling detection logic.

TAXII 2.0/2.1 is a native Cortex XSIAM threat intelligence ingestion protocol, satisfying the stem's requirement for natively supported feed formats. It transports STIX-structured indicators over HTTPS collections, letting XSIAM poll external providers directly without custom parsing or intermediary tooling.

Tagging categorises indicators by campaign, actor, or severity, enabling analysts to filter and pivot during threat hunting rather than scanning the full indicator set. This directly satisfies the stem's requirement for targeted hunting and filtering, since tags create the grouping axis that narrows investigations to relevant indicators.

Domain names act as external seed assets: XSIAM resolves and enumerates them to discover related hosts, subdomains and exposed services. This directly initiates Attack Surface Management discovery, unlike internal IP ranges or cloud account IDs, which scope internal or cloud-native assets instead.

Associated vulnerability references, such as CVEs, are included in the ASM finding record, linking the exposed external service to known exploits. This satisfies the stem by supplying concrete remediation context beyond asset and port details.

ASM classifies assets as registered or unregistered based on whether discovered attributes such as domain names, certificates, or WHOIS data match the organization's configured registration attributes. An IP inside a discovery scope can still be labeled unregistered if its associated domain or certificate belongs to an entity not defined as owned by the organization.

Slowing the fetch cadence reduces ingestion pressure, and filtering at the source limits the volume of indicators stored and matched. This directly addresses the resource contention that is degrading indicator searches and starving other feeds, while still preserving coverage of the indicators that matter to the organization. It is the most targeted remediation because it fixes the cause rather than masking symptoms.

Threat Intelligence correlation rules generate security incidents when internal telemetry matches indicators, giving the analyst a curated, pre-correlated view with severity and context. This satisfies the investigation requirement without manually writing queries against raw datasets.

CT logs, DNS brute-forcing and external port scanning operate entirely from outside the cloud tenancy, so no internal credentials are needed. Certificate entries and DNS records reveal hostnames and storage endpoints, while port scanning confirms exposed services — satisfying the stem's credential-free discovery constraint for the rogue bucket.

The ASM asset inventory in Cortex XSIAM lists discovered external assets such as IP addresses, domains, and services along with their attributes. Reviewing this inventory lets the analyst confirm which assets belong to the organization's footprint and spot unexpected exposures, which is precisely the validation task described.

Attack Surface Management > Assets lists the discovered external assets, shadow IT and exposed services that ASM has enumerated, satisfying the requirement to review them in the XSIAM interface. This view is the dedicated inventory for externally observed exposure, rather than alerts or incidents.

When an indicator has no matching record in the indicator store, XSIAM cannot assign a reputation or list contributing sources, so the verdict defaults to Unknown. The feeds are healthy but simply do not contain this specific IP, meaning enrichment produced no match. This is expected behavior, not a configuration fault, and the analyst must rely on internal telemetry and manual research rather than feed-derived reputation.

Cortex XSIAM includes native support for STIX and TAXII, allowing analysts to ingest standards-compliant threat intelligence feeds directly. This means a STIX 2.1 feed can be consumed without writing a custom parser or transformation, which is exactly what the analyst needs to confirm before enabling the feed.

XSIAM provides an enrichment action that queries configured threat intelligence sources for a given entity such as an IP and returns matching indicators with their sources and verdicts. Running it on the incident's IP entity produces a consolidated list, which is exactly what the scenario requires for correlation.

The Threat Intelligence module matches artifacts from alerts and telemetry against ingested indicators, surfacing reputation, sources, and context. This enrichment helps analysts quickly assess whether an observed IP, domain, or hash is likely malicious without leaving the console. It is the core operational value during triage because it adds external perspective to internal evidence, speeding decisions about escalation, containment, or dismissal.

Correlation rule logic supports conditions on indicator attributes, so filtering by source reliability or confidence threshold excludes low-confidence feed matches while still triggering on high-confidence ones, satisfying the requirement to scope this rule to trusted indicators only.

ASM discovers external assets from seed assets defined in discovery scopes. Adding the subsidiary's root domains and CIDR ranges as seeds gives ASM the starting points it needs to enumerate related subdomains, IPs, and services in subsequent scans. This directly addresses the missing coverage and ensures the subsidiary is included in continuous discovery without relying on manual asset entry or one-time scans.

A rotated API key invalidates the credential stored in the feed integration instance, causing authentication failures and a Disconnected status with no new indicators. Updating the credential and running the integration's test command confirms connectivity, after which the feed resumes fetching indicators. This is the direct cause-and-effect fix for the observed symptom.

Threat intelligence feed integrations in Cortex XSIAM fetch indicators from external sources and can be configured to enrich alerts with reputation and related context. Enabling the integration instance and its enrichment options lets the platform automatically attach indicator data to matching alerts, which is exactly the analyst's goal.

ASM asset management lets analysts apply classifications or tags to discovered assets, and those classifications can carry ownership and criticality metadata. By tagging the internet-facing server appropriately, the analyst enriches the asset record so future findings inherit the owner and priority, enabling correct routing and prioritization of ASM alerts.

The indicator repository is where ingested indicators are stored, and it can be filtered by source. Checking for indicators tagged with the feed's source and recent timestamps directly confirms ingestion succeeded and that the data is available for investigation, without depending on a correlation rule to fire first.

CVE records alone describe the vulnerability but do not state whether it is being exploited. Cortex XSIAM enriches ASM findings with threat intelligence that carries exploitation and trending signals, letting the analyst confirm active in-the-wild abuse before assigning remediation priority. This is the correct source because it merges the ASM exposure context with live exploitation telemetry rather than static vulnerability metadata.

ASM continuously scans and inventories internet-facing assets, attributing them to the organisation and flagging exposures such as open ports, expired certificates and leaked credentials. This external attack surface visibility feeds XSIAM's risk scoring, distinct from internal endpoint or network detection.

Assigning severity and ownership turns raw findings into triaged work, letting the team focus on high-impact exposure and ignore accepted low-risk items. It reduces perceived noise by organizing output rather than hiding it. Combined with classification rules, this creates a sustainable workflow where ASM findings map to accountable owners and meaningful risk, which is exactly what effective tuning requires.

Weak or misconfigured TLS, including expired, self-signed, or deprecated-protocol certificates, exposes encrypted traffic to interception or indicates neglected infrastructure. These findings represent a concrete security weakness on the external surface, so they belong in the elevated-risk set the analyst wants to investigate ahead of benign exposures.

ASM only enumerates assets that fall within configured seeds and ports that are in scope. If the hostname is outside the seed set, or the service listens on a port the scan does not probe, the asset will not appear even though it is reachable. Checking seed coverage and port scope is the most direct way to explain a missed asset.

Stored indicators are evaluated during correlation against telemetry, and matches can raise alerts or contribute to incidents. This enrichment and matching behavior is a core purpose of ingesting threat intelligence, letting analysts see when internal activity aligns with known malicious indicators and respond through the incident workflow.

ASM discovers assets based on the seeds provided in the scope. Using public domain names and public IP ranges as seeds restricts discovery to internet-facing assets, which matches the requirement to exclude internal-only hosts. This is the correct way to bound the discovery surface to external reachability.

Allow listing indicators marks them as known-good within Cortex XSIAM, so correlation rules and detection logic skip them while the indicators remain in the indicator store. This satisfies the requirement to suppress false-positive matches without deleting the indicators or disabling the feed, and it preserves the audit trail of what was ingested.

The API authentication key, token, or credentials authenticate Cortex XSIAM to the external threat intelligence provider, which rejects unauthenticated requests. This satisfies the stem's API-based ingestion requirement by authorising each poll of the configured feed endpoint.

The indicator detail view in Cortex XSIAM aggregates the contributing feeds, confidence values, tags, and related metadata for a given indicator. Reviewing it tells the analyst which sources flagged the address, how strongly, and what context those sources attached, which directly answers why the indicator is considered malicious and how trustworthy the match is.

The Generic Feed integration accepts arbitrary JSON and lets you define custom JSON path mappings, so fields from the proprietary schema are extracted into XSIAM's expected indicators format. This directly satisfies the non-standard format constraint without writing a bespoke parser or transforming the feed externally before ingestion.

Feed integrations in XSIAM allow analysts to define the reputation and severity applied to ingested indicators. Setting a high severity for a high-confidence feed causes incidents correlated with those indicators to inherit elevated severity, while lower-confidence feeds retain their own lower severity values, achieving selective impact.

The ASM Findings table lists all discovered issues. Clicking a finding opens a detailed side panel that includes the service banner, risk description, and recommended remediation steps. This is the primary location for analysts to investigate and act on ASM findings, making it the correct answer.

ASM only discovers and scans assets within its configured seed domains and IP ranges. Newly acquired subsidiary ranges absent from that scope are never enumerated, so they cannot appear in the asset inventory regardless of scan health.

Clicking the asset in the Attack Surface Management inventory opens its risk and finding details pane, which surfaces the certificate finding's context and remediation guidance. This directly satisfies the stem's requirement to view detailed finding context for the flagged external web server, since ASM consolidates per-asset findings there rather than in alert or endpoint views.

Seeding ASM with registered domain names and related organizational identifiers lets Cortex XSIAM expand discovery automatically, enumerating subdomains, related hosts, and external-facing services as the footprint grows. This delivers continuous discovery without per-host manual entry, which is exactly what the team needs when new subsidiaries are onboarded.

The Threat Intelligence module can perform enrichment lookups that query configured intelligence sources for a specific artifact, returning reputation and context even when the value is not yet in the local store. This lets the analyst investigate the domain in-platform rather than pivoting to external tools. It is the intended capability for on-demand checks during an active investigation of an unlisted indicator.