2.2 Configure Automation and Feed Integrations (e.g., Messaging, SIEM, Authentication, Threat Intelligence Feeds) XSIAM-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A threat intelligence feed is being ingested into XSIAM, but the indicators are not appearing in the incident enrichment. The feed shows as 'active' in the integration list. What should the analyst check next?

   • AEnsure that the feed is also configured as a SIEM integration.
   • BConfirm that the feed is linked to an email integration.
   • CCheck if the feed is being used in a playbook.
   • DVerify that the feed data is being parsed correctly and that the indicators are in a supported format.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to automatically block an IP address in their firewall when a threat intelligence feed indicates it is malicious. They have a playbook that queries the feed and extracts the IP. What should they add to the playbook to complete the automation?

   • AAdd an email notification to inform the security team about the IP.
   • BAdd an action to send the IP to the firewall via its API.
   • CAdd an LDAP authentication step to verify the IP.
   • DAdd a SIEM integration to ingest the IP as a security event.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SIEM integration in XSIAM is failing to ingest events. The administrator has verified that the API endpoint is reachable and the credentials are valid. The integration logs show an 'authentication failed' error. What is the most likely cause?

   • AThe integration is not assigned to any playbook.
   • BThe API key has been rotated on the external SIEM side but not updated in XSIAM.
   • CThe feed format is not supported by XSIAM.
   • DThe SIEM integration is not linked to an LDAP directory.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst notices that a threat intelligence feed in XSIAM is not updating as expected. The feed was configured with a daily schedule, but the last successful update was three days ago. What should the analyst check first?

   • AVerify the feed URL is still accessible and the API key is valid.
   • BConfirm that the feed is in STIX format.
   • CCheck if the feed is being used in any playbooks.
   • DEnsure that the feed is assigned to a SIEM integration.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is an example of a threat intelligence feed format commonly used in XSIAM?

   • ADOCX
   • BMP4
   • CCSV
   • DPDF
   Reveal Solution Discussion Select an answer first