5.2 Explain Indicator Creation Methods XSOAR-ENGINEER Practice Questions (Page 6)

Questions 26–26

1. 26application · medium

   During an incident response playbook, a security analyst wants to automatically create an indicator for a malicious file hash that was extracted from a phishing email. The playbook already has the hash value in a context field. Which playbook task should be used to create the indicator?

   • AA task that manually adds the hash to the indicators page after the playbook completes.
   • BA task that sends the hash to an external API and then manually copies the response into XSOAR.
   • CA task that exports the hash to a CSV file and then imports it using the bulk import feature.
   • DA task that uses the 'Create Indicator' automation script, passing the hash value and setting the indicator type to 'File'.
   Reveal Solution Discussion Select an answer first