5.2 Explain Indicator Creation Methods XSOAR-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A threat intel analyst has a CSV file with 5,000 indicators from a trusted feed. The file contains columns: 'type', 'value', 'first_seen', 'source', and 'confidence'. The analyst wants to import these into XSOAR so that each indicator is created with its type and value, and the other columns are preserved as indicator fields. The analyst also wants to avoid creating duplicate entries for indicators that already exist in XSOAR. What is the most efficient way to accomplish this?

   • AUpload the CSV directly to the XSOAR server's file system and run a custom cron job to parse and insert the indicators into the database.
   • BManually create each indicator via the XSOAR web interface, entering the type, value, and other attributes one by one.
   • CUse the XSOAR API to write a script that creates each indicator, but only include the 'value' field to keep the payload simple.
   • DUse the 'Import Indicators' playbook to ingest the CSV, mapping the columns to the corresponding indicator fields, and enable deduplication.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A threat intel team has a strict policy that all indicators must be validated before being used in active detection. They have a process where indicators are created with a 'Pending' status, then a senior analyst reviews and sets them to 'Active'. Recently, a junior analyst created an indicator via the API with a 'Pending' status, but the senior analyst is on leave. What is the best way to ensure the indicator is properly validated without delaying the process?

   • ALeave the indicator as 'Pending' until the senior analyst returns.
   • BCreate an automated playbook that validates the indicator using external threat intel sources and, if the validation passes, automatically sets the status to 'Active'.
   • CHave the junior analyst manually set the status to 'Active' after a quick review.
   • DDelete the indicator and recreate it with an 'Active' status.
   Reveal Solution Discussion Select an answer first
4. 23application · easy

   A junior analyst needs to add a single IP address to XSOAR as an indicator. The analyst has the IP address and wants to ensure it is properly typed and can be used in future investigations. What is the most direct way to accomplish this?

   • AUse the XSOAR API to create the indicator, but you must first generate a new API key and write a script.
   • BNavigate to the Indicators page, click 'Add Indicator', select the type 'IP', enter the IP address, and save.
   • CImport a CSV file that contains the single IP address, but you must first create the CSV file.
   • DCreate a new incident and use the 'Create Indicator' playbook task, but the playbook requires a full incident context.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is manually creating an indicator for a domain that already exists in XSOAR but with a different source. The analyst wants to preserve the existing indicator's enrichment data while adding the new source information. What will happen if the analyst creates the indicator with the same domain value?

   • AXSOAR will create a duplicate indicator, and the enrichment data will be lost.
   • BXSOAR will update the existing indicator with the new source information and retain the enrichment data.
   • CXSOAR will create a second indicator with a different internal ID, and both will appear in the indicators list.
   • DXSOAR will reject the creation because the indicator already exists and no changes will be made.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How can a playbook create an indicator during incident response?

   • ABy editing the indicator database directly
   • BBy sending an email to the XSOAR server
   • CBy using a 'Create Indicator' task in the playbook
   • DBy manually adding the indicator to the incident
   Reveal Solution Discussion Select an answer first