CCNA Threat Intelligence Management Questions

TIM supports exclusion lists that prevent matching indicators from being ingested or from receiving a malicious reputation. By adding the scanner range to an exclusion list and attaching it to the relevant feed instances, the engineer guarantees those IPs are never marked bad, regardless of what any public feed reports. This directly satisfies the requirement.

Execution logs capture the raw HTTP response, status codes and parser exceptions for each fetch, revealing malformed fields, unexpected schemas or authentication failures. This pinpoints whether the feed's incoming data or the integration's parsing logic causes the failure.

When multiple feeds update the same indicator, Cortex XSOAR recalculates the score from the latest feed data by default. If Feed A and Feed B run in an alternating or nondeterministic order, the indicator's reputation flips between Bad and Benign-derived values. The fluctuation reflects feed execution order rather than analyst action, which matches the observed pattern.

Non-standard JSON nests indicators unpredictably, so correct JSONPath expressions are essential to extract each field reliably. Without accurate paths, the parser returns nulls or wrong values, breaking indicator ingestion before any schema mapping can occur.

The Indicator Details page in Cortex XSOAR includes a Sources section that enumerates every feed or integration that contributed to the indicator's aggregated score, showing each source's individual reputation value. This lets the analyst trace a score of 3 back to its originating feed and decide whether that feed is trustworthy before acting on the indicator.

Selecting URL stores each feed entry as a URL indicator, letting Cortex XSOAR match, extract and enrich malicious web addresses directly against that indicator type. This satisfies the stem's constraint of supplying malicious URL strings, since the URL type applies URL-specific regex extraction and reputation commands rather than treating entries as generic domains or files.

Correlation depends on indicator matching being enabled and the incident type being configured to correlate indicators. If matching is disabled globally, or the incident type lacks that configuration, fetched indicators exist but never trigger correlation when matching observables appear in new incidents.

Threat Intel Dashboards in the Overview workspace aggregate indicator counts, type breakdowns, and top malicious sources from the threat intel database, directly satisfying the stem's requirement for summary metrics. Unlike the Indicators page, which lists individual records, dashboards present pre-computed visualisations without manual querying.

The Tags parameter on a feed instance accepts a comma-separated list of tags that are automatically applied to every indicator ingested by that feed. This directly fulfills the requirement to tag indicators from the MISP feed for filtering and correlation. Tags are searchable and can be used in indicator queries and playbooks.

Source weights in Indicator Scoring settings let you assign Feed A a higher reliability value than Feed B, so its reputation dominates when the two contradict. Precedence resolves the conflict deterministically, stopping the indicator's score from oscillating between malicious and benign as each feed refreshes.

The TAXII Server URL, whether discovery or collection endpoint, is mandatory so Cortex XSOAR knows where to poll STIX objects. It satisfies the stem as one of the two required advanced configurations, defining the feed's source before authentication is applied.

A conditional task evaluates the indicator's score field and controls task routing based on the result. By placing it before the enrichment and branching only for Suspicious or Bad scores, the playbook guarantees the premium enrichment runs exclusively for those indicators, avoiding unnecessary API calls and cost.

Reputation is the global scoring attribute XSOAR uses when evaluating indicators, so setting it to Benign or False Positive stops the indicator from triggering detections across all integrations and playbooks, neutralising the false positive without deleting the indicator.

Built-in export features push indicators outward through integration instances such as Filebeat, Syslog, or API export, satisfying the requirement to move threat indicators from Cortex XSOAR into external systems. These mechanisms operate at the integration layer, forwarding enriched indicator data to SIEMs, log platforms, or third-party APIs without custom development.

Cortex XSOAR applies type-specific normalisation rules, such as lowercasing domains, before merging duplicate indicators into a single entry. This satisfies the stem's mixed-case feed scenario, preventing redundant indicators that would otherwise inflate counts and skew enrichment.

Cortex XSOAR refreshes an indicator's expiration timer whenever the feed sees it again, so the 30-day window restarts on each observation. Indicators persist if the feed keeps returning them, and they expire only after the configured period with no sightings. Reputation is the combined DBotScore across all sources, so a Good score from another integration can outweigh or blend with the Bad score from this feed, producing a Good reputation.

Trust level adjusts the weight applied when aggregating source reputations into an indicator's score. Marking a feed Good raises its contribution, so a conflicting malicious feed with lower trust may be outweighed, leaving the indicator scored as benign rather than malicious.

The Source parameter on a feed instance specifies the source label attached to every indicator ingested by that feed. When an indicator already exists, this source is added to its list of sources, linking it to the new feed. Reviewing and setting this parameter correctly ensures existing indicators are associated with the feed's source.

The failure stems from Cortex XSOAR's trust store not recognising the feed's self-signed certificate. Disabling SSL verification on that integration instance bypasses validation, while importing the issuing CA into the trust store establishes a valid chain, both restoring the scheduled feed.

Management rules support conditions and actions such as tagging, and expiration rules can be scoped to exclude tagged indicators. A high-priority rule that tags the internal feed indicators and an expiration rule that skips tagged indicators together prevent automatic expiry. This directly and explicitly protects the indicators as required, making it the correct configuration.

Cortex XSOAR extracts indicators during incident creation using extraction rules that map regex patterns to indicator types. For a custom type, you define a regex in the extraction configuration and link the reputation command to the indicator type so the platform knows how to enrich it. This combination enables automatic identification of CryptocurrencyAddress values in incident evidence and triggers the associated reputation command, updating the indicator's DBotScore without manual analyst action.

The lookback period (first fetch) defines the historical window queried on the integration's initial run, satisfying the requirement to pull past indicators. Subsequent scheduled fetches use the last-run timestamp instead, so only this parameter governs how far back the first ingestion reaches.

Bulk tagging and reputation updates operate directly on selected indicators within the Threat Intel workspace, satisfying the stem's requirement for actions available when managing indicators. This mechanism lets administrators apply consistent classification and scoring across many indicators at once, rather than editing each individually, which the workspace explicitly supports.

The related incidents list surfaces other incidents sharing the same indicators, letting analysts pivot from a threat-feed indicator to prior or concurrent investigations. This correlation satisfies the stem's requirement for investigating indicators drawn from threat feeds.

Fetch interval frequency governs how often the integration polls the REST endpoint, satisfying the requirement for a scheduling parameter. Generic REST feeds need this to control data ingestion cadence, as Cortex XSOAR cannot infer polling timing from the API itself. It is distinct from authentication and endpoint URL parameters, which define access rather than retrieval timing.

Source trust levels and weights directly determine how much each feed's verdict contributes to the aggregated reputation calculation. When feeds conflict, Cortex XSOAR applies the configured reliability weighting per source, so a higher-trust feed's malicious verdict outweighs a lower-trust feed's benign verdict, satisfying the stem's requirement to resolve conflicting data.

Cortex XSOAR allows administrators to upload custom CA certificates to the trusted store via the 'Certificates' page in Settings. Once imported, the integration can validate the server's certificate without disabling SSL verification. This maintains secure communication and resolves the verification error. It is the recommended approach for self-signed certificates in production.

Cortex XSOAR ingests file hashes (MD5, SHA1, SHA256) as indicators out-of-the-box, mapping them to the File indicator type for reputation lookups and enrichment. This native support lets analysts correlate hash-based threat intelligence without custom parsing or integration development.

Performing the WHOIS lookup inside the feed integration's fetch logic lets the engineer validate each indicator before it is returned to the platform for storage. Indicators that fail enrichment are simply not emitted, satisfying the block-on-failure requirement. Because the feed integration controls what reaches the indicator database, this is the only listed approach that can truly prevent storage of unenriched indicators.

The Threat Intel page hosts the indicator database and its details view, which surfaces the indicator's reputation, contributing feed sources, first-seen and last-seen timestamps, and related attributes in one consolidated screen. Searching the hash there directly answers the analyst's need for feed provenance and current score without running commands or sifting through incidents. This is the canonical location for inspecting stored indicators.

Expiration threshold rules based on last seen time let Cortex XSOAR automatically age out indicators that have not been observed within a defined window, directly governing indicator lifecycle. This satisfies the requirement to manage how long indicators remain active before expiry.

The Timeline or History tab records each reputation score change for the indicator, with timestamps and the source that triggered the update. This directly satisfies the analyst's requirement to view historical reputation changes over time, rather than only the current score or related incidents.

Configuring the client ID, client secret, and token URL in the OAuth2 fields lets the integration request and refresh access tokens automatically, satisfying the token rotation requirement. Hardcoding a static token would fail once rotation invalidates it.

The indicator details page includes a Sources field that enumerates every feed or manual source that has reported the indicator. This directly answers which threat intelligence sources contributed to its reputation. By reviewing this field, the analyst can see the origin of the malicious classification and assess trustworthiness of each source.

In the incident's Indicators tab, each indicator is listed, and clicking the indicator value opens its full Indicator Details page. That view shows the current reputation, the DBotScore contributions from each integration, related incidents, and timestamps such as when it was last seen. This is the standard way to inspect enrichment details for a specific IP from within an incident, giving the analyst the complete context.

In Cortex XSOAR, an indicator's expiration is determined by the maximum expiration among all its sources. If another feed reports the same indicator with a longer expiration or no expiration, the indicator will not expire until that source's expiration passes. This is the most likely reason the indicators remain despite the 30-day setting on one feed.

The Indicator Details view surfaces the indicator's current reputation and calculated score, letting analysts judge severity at a glance. This reputation value reflects aggregated threat intelligence verdicts, satisfying the stem's requirement for details visible within an individual indicator's record.

Outgoing indicator properties are governed by the STIX/TAXII server's mapping rules, which translate Cortex XSOAR fields into STIX objects. If custom fields are unmapped, recipients never receive them. Checking these outgoing mapping rules directly addresses the reported missing custom fields.

The TAXII2 integration parses each STIX object's pattern and maps recognized types (for example ipv4-addr, domain-name, file hashes) to Cortex XSOAR indicator types. Pattern types it cannot map, like network-traffic, are silently dropped rather than raising an error, which matches the successful fetch with missing indicators. Engineers must pre-process or convert such objects before ingestion.

Toggling the integration instance's active status preserves all configured parameters, indicator reputation settings and field mappings while halting scheduled fetches, satisfying the requirement to silence the noisy feed temporarily without losing its configuration. Re-enabling later restores the same instance rather than requiring reconfiguration from scratch.

Because the SIEM accepts indicators over a REST API, the engineer can build a custom integration or automation script that formats and POSTs indicators to that endpoint, triggered on a schedule or by a playbook. This is a valid outbound mechanism when no dedicated pack exists. It correctly addresses the SIEM leg of the requirement by leveraging the platform's scripting and integration framework.

The Generic Feed integration, built on the GenericFeed module, parses arbitrary JSON structures by mapping custom indicator fields, so non-standard threat feeds can be ingested without a bespoke integration. It satisfies the stem's custom-structure requirement directly.

Enabling fetch indicators on the TAXII integration instance is the prerequisite for scheduled ingestion; without it, XSOAR never polls the collection, so no indicators reach the Threat Intel page regardless of server connectivity. This directly satisfies the stem's requirement to verify the ingestion pipeline first, before investigating parsing, reputation, or indicator-type mapping.

The TAXII2 Server integration turns Cortex XSOAR into a TAXII 2.x server, allowing external consumers to pull indicators from collections you expose. This is a supported export mechanism because the partner's TAXII client can query the endpoint and retrieve indicators in STIX format. It directly satisfies the requirement to share indicators with an external partner's TAXII infrastructure without custom code, using the platform's built-in server capability.

The Indicators page under Threat Intel provides a New Indicator action, letting an analyst enter a single domain manually and commit it straight to the database. This is the most direct route for one known malicious domain.

In TAXII 2.1 and STIX feed integrations, the 'Fetch indicators' parameter must be enabled for retrieved objects to be parsed and written into the Threat Intel database. If it is disabled, manual fetch returns raw objects but no indicators are created, which exactly matches the reported symptom of a successful fetch with an empty Threat Intel page.