Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 12)

Questions 56–56

1. 56application · medium

   A company has implemented multiple automation playbooks that enrich indicators from several external feeds. Analysts are now spending more time investigating alerts because many indicators are flagged as malicious by one feed but benign by another. What is the best practice to address this challenge?

   • ADisable all automation and have analysts manually check each feed
   • BIncrease the frequency of enrichment to get more up-to-date data
   • CImplement a scoring or consensus mechanism in the playbook that weighs feed reliability and requires a minimum score before escalating
   • DRemove all external feeds and rely only on internal telemetry
   Reveal Solution Discussion Select an answer first