6.1 Import and Manage Indicators XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large enterprise receives threat intelligence from multiple sources: a STIX/TAXII feed, a CSV file from a partner, and an internal API. The team wants to automate the ingestion of all three sources into XSIAM. However, the CSV file sometimes contains duplicate indicators that also appear in the STIX feed. The team needs to ensure that duplicates are handled consistently and that the source of each indicator is tracked. What is the best approach?

   • AImport all sources manually and rely on XSIAM's automatic deduplication to handle conflicts.
   • BUse only the STIX/TAXII feed and ignore the CSV and API sources.
   • CConfigure separate automated integrations for each source and use XSIAM's deduplication and conflict resolution features.
   • DConsolidate all sources into a single CSV file and upload it manually each day.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An organization imports indicators from two different sources. Source A provides an IP address marked as 'malicious' with high confidence. Source B provides the same IP address marked as 'benign' with medium confidence. The analyst needs to resolve this conflict so that the indicator's status reflects the most reliable information. What is the best approach in XSIAM?

   • AReview the conflict in the XSIAM conflict resolution interface and choose the appropriate source to trust.
   • BSet the indicator to 'expired' to avoid the conflict.
   • CManually edit the indicator to set the status to 'malicious' based on the higher confidence source.
   • DDelete the indicator and re-import it from Source A only.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which process adds additional context, such as geolocation or threat actor information, to an imported indicator?

   • AEnrichment
   • BDeletion
   • CDeduplication
   • DValidation
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security operations center (SOC) manages a large indicator collection that is used by multiple detection rules. An analyst needs to update the 'expiration_date' for a subset of indicators in this collection. The analyst wants to ensure that the update does not disrupt the detection rules that reference these indicators. What is the best approach?

   • AExport the collection, modify the CSV, and re-import it.
   • BEdit the expiration_date field directly on each indicator in the collection.
   • CCreate a new collection with the updated indicators and update the detection rules to use the new collection.
   • DDelete the indicators and re-create them with the new expiration dates.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst imports a list of SHA256 hashes from an internal sandboxing tool. After import, the analyst notices that XSIAM has added 'first_seen', 'last_seen', and 'source_reputation' fields to each indicator. What process is responsible for this?

   • AIndicator deduplication, which merges data from multiple sources.
   • BIndicator parsing, which extracts fields from the original file.
   • CIndicator validation, which checks the hash format and length.
   • DIndicator enrichment, which adds additional context from internal and external intelligence sources.
   Reveal Solution Discussion Select an answer first