5.2 Explain Indicator Creation Methods XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A threat intel analyst is importing a CSV file with 10,000 indicators. The file contains a column 'indicator_type' that specifies the type for each row, and a column 'value' with the indicator value. The analyst wants to ensure that the import does not create duplicates. What is the best way to configure the import?

   • AImport the CSV without mapping, and then manually clean up duplicates after the import.
   • BPre-process the CSV to remove duplicates before importing, and then map the columns.
   • CMap the 'indicator_type' column to the indicator type field and the 'value' column to the value field, and rely on XSOAR's deduplication.
   • DMap only the 'value' column and let XSOAR auto-detect the type from the value format.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When manually creating an indicator in XSOAR, which of the following is a required attribute?

   • AIndicator type
   • BSource
   • CExpiration date
   • DTags
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What does XSOAR do to enrich indicators after they are created?

   • AIt encrypts the indicator value
   • BIt automatically adds reputation and context from integrated threat intelligence sources
   • CIt sends the indicator to all users for manual review
   • DIt assigns a random score to each indicator
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An incident response playbook creates indicators for all IPs found in a phishing email. The playbook is triggered by an incident, and the IPs are extracted from the email headers. The team wants to ensure that only IPs that are not already in XSOAR are created as new indicators, and that existing indicators are not modified. What is the best way to achieve this?

   • AUse the 'Create Indicator' script, which automatically skips existing indicators.
   • BCreate a separate list of existing indicators and manually compare before creating.
   • CUse the bulk import feature with a deduplication setting that prevents updates to existing indicators.
   • DUse a playbook task that checks if the indicator exists before creating it, and only creates if it does not exist.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC receives a large CSV file with indicators from a new threat intel vendor. The file has columns: 'type', 'value', 'confidence', and 'notes'. The SOC wants to import this file, but they are concerned about data quality. They want to ensure that only indicators with a confidence score above 50 are imported. What is the best approach?

   • AAsk the vendor to resend the file with only high-confidence indicators.
   • BImport the entire file and then manually delete indicators with low confidence.
   • CUse a playbook that reads the CSV, filters rows based on confidence, and then creates indicators for the filtered rows.
   • DUse the bulk import feature and set a filter in the import settings to exclude low-confidence indicators.
   Reveal Solution Discussion Select an answer first