5.2 Explain Indicator Creation Methods XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an automated method for creating indicators in XSOAR?

   • AUsing the Indicators page to manually add a single indicator
   • BManually typing an indicator into the search bar
   • CExecuting a playbook that uses a Create Indicator task
   • DImporting a CSV file from the Indicators page
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security engineer wants to automate the creation of indicators in XSOAR from an external threat intelligence platform. The engineer has an API key with appropriate permissions and wants to push a single new malicious domain to XSOAR as soon as it is discovered. Which approach should the engineer use?

   • AWrite a script that calls the XSOAR API endpoint to create an indicator, including the indicator type and value in the JSON payload.
   • BConfigure the external platform to send an email to the XSOAR mailbox, and then use a mail listener to create the indicator.
   • CManually add the domain through the XSOAR web interface each time a new domain is discovered.
   • DUse the 'Create Indicator' playbook, but it requires a human to approve each indicator before it is created.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An analyst is manually creating an indicator for a file hash. The analyst notices that the hash is already in XSOAR but with a different file name. The analyst wants to add the new file name to the existing indicator without changing the hash value. What is the best way to do this?

   • AUse the API to create a new indicator with the same hash and a different type.
   • BDelete the existing indicator and recreate it with both file names.
   • CEdit the existing indicator and add the new file name to the 'File Name' field.
   • DCreate a new indicator with the same hash and the new file name, and rely on XSOAR to merge them.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is required to create an indicator via the XSOAR API?

   • AA CSV file and a playbook
   • BA web browser and a user account
   • CA VPN connection to the XSOAR server
   • DAn API key and a valid payload
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the XSOAR interface, where would an analyst go to manually create a single indicator?

   • AThe Playbooks page
   • BThe Settings page
   • CThe Indicators page
   • DThe Incidents page
   Reveal Solution Discussion Select an answer first