3.3 Manage Detection Rules to Align with Provided Requirements XSIAM-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security operations center (SOC) receives a threat intelligence feed that includes a list of malicious IPs, domains, and file hashes. The SOC wants to create detection rules that trigger on any of these IOCs, but they are concerned about the volume of alerts. They decide to prioritize alerts based on the type of IOC, with file hashes being the highest priority, followed by domains, and then IPs. What is the most efficient way to achieve this?

   • ACreate an ASM rule that monitors for the IOCs in external threat feeds.
   • BCreate three separate indicator rules (one for each IOC type) and use a scoring rule to assign different risk scores to each type.
   • CCreate a correlation rule that triggers only when all three IOC types are observed together.
   • DCreate a single indicator rule that includes all IOCs and assign a static risk score.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary function of a scoring rule in XSIAM?

   • ATo automatically block all high-risk entities
   • BTo store risk scores in a separate database
   • CTo assign risk scores to entities or events based on predefined criteria
   • DTo replace the need for indicator rules
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of a Behavioral Indicator of Compromise (BIOC)?

   • AA domain name that is known to be malicious
   • BAn IP address that is listed on a threat intelligence feed
   • CA process that repeatedly attempts to access the Windows registry
   • DA file hash matching a known malware sample
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations team wants to reduce alert fatigue by ensuring that only high-risk events are escalated to the incident response team. They have a detection rule that triggers on suspicious PowerShell usage, but they want to assign a higher risk score when the PowerShell usage is combined with network connections to external IPs. What should they do?

   • ACreate an ASM rule that monitors for external IPs in the organization's network logs.
   • BCreate a second indicator rule that only triggers on external network connections.
   • CModify the existing indicator rule to only trigger when both conditions are present.
   • DCreate a scoring rule that increases the risk score when both PowerShell usage and external network connections are present.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat hunter notices that a compromised user account is performing an unusual sequence of actions: logging in from a new location, then accessing a sensitive share, then downloading a large volume of data. The hunter wants to create a detection rule that captures this specific behavioral pattern rather than relying on static indicators. What should the hunter create?

   • AAn ASM rule that monitors for exposed sensitive shares on the network.
   • BA scoring rule that assigns a high risk score to any user who logs in from a new location.
   • CAn indicator rule that matches on the specific IP address used in the new location.
   • DA correlation rule that combines the sequence of login, access, and download events into a single detection.
   Reveal Solution Discussion Select an answer first