5.6 Explain Threat Intel Sharing with External Security Services XSOAR-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   How does XSOAR typically integrate with external security services for threat intel sharing?

   • ABy requiring manual export of threat intel to a shared folder
   • BThrough built-in integrations and the use of the XSOAR API
   • CBy using a proprietary protocol that only works with Palo Alto Networks products
   • DBy installing a separate agent on each external service
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A threat intel team wants to share indicators with an external service that requires a specific schema. The team's XSOAR instance has indicators with various custom fields. What is the best way to ensure the indicators meet the external service's schema?

   • AUse a different external service that accepts the current schema.
   • BManually edit each indicator to fit the schema.
   • CUse XSOAR's field mapping and transformation capabilities to map custom fields to the required schema.
   • DShare the indicators as-is and let the external service handle the schema mismatch.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security operations center (SOC) uses XSOAR to manage incidents. They want to automatically share indicators of compromise (IOCs) with their external threat intelligence platform (TIP) whenever a new incident is created. The TIP provides a REST API that accepts JSON payloads. Which XSOAR feature should the SOC use to achieve this integration?

   • AConfigure a syslog forwarder in XSOAR to send IOCs to the TIP's syslog collector.
   • BManually export IOCs as a CSV file and upload them to the TIP via its web interface.
   • CConfigure a custom integration in XSOAR that calls the TIP's REST API and invoke it from a playbook triggered on incident creation.
   • DUse the built-in email integration to send IOCs to the TIP's support email address.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a key advantage of using playbooks for threat intel sharing?

   • AIt eliminates the need for threat intel validation
   • BIt requires less technical expertise to set up
   • CIt ensures consistent and timely sharing without manual intervention
   • DIt guarantees that all shared intel is accurate
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is a compliance consideration when sharing threat intel externally?

   • AEnsuring the sharing agreement complies with data protection regulations
   • BEnsuring the external service uses the same operating system
   • CEnsuring the external service has a large user base
   • DEnsuring the external service is located in the same country
   Reveal Solution Discussion Select an answer first