What is the primary purpose of threat intelligence enrichment in Cortex XSOAR?

To encrypt indicators for secure storage

To remove indicators that are no longer relevant from the database

To automatically block all indicators that are enriched

To add additional context and information to indicators from integrated feeds and services

An analyst is investigating an incident and wants to enrich a suspicious domain with data from VirusTotal and WHOIS. They want the enrichment results to be stored on the indicator for future reference. What should they do?

Run the 'Enrichment' playbook on the indicator, which will query the integrations and save results to the indicator

Create a new incident for the domain and add the enrichment data as incident fields

Use the 'Reputation' command on the domain, which automatically enriches with all configured feeds

Manually open VirusTotal and WHOIS websites and copy the results into a note

A threat intelligence team needs to share a subset of indicators with a partner. The partner only wants indicators that are related to a specific campaign and have a confidence score above 70. The indicators are stored in XSOAR with custom fields for campaign and confidence. What is the most efficient way to export only the relevant indicators?

Use the Indicators page to filter by campaign and confidence, then export the filtered results

Create a custom script that queries the indicators and exports them to a file

Use a playbook to export indicators that meet the criteria to a STIX file

Export all indicators and let the partner filter them

A threat intelligence team has curated a set of high-confidence indicators in XSOAR and wants to share them with a partner organization that uses a different threat intelligence platform. The partner can consume STIX 2.1. What is the most appropriate way to export the indicators?

Export the indicators as a CSV file and email it to the partner

Use the built-in STIX 2.1 export feature to generate a bundle of indicators

Create a custom integration to push indicators to the partner's API

Print the indicator list and share it as a PDF

Palo Alto NetworksCertified XSOAR Engineer

Domain 5Objective 1

5.1 Identify and Describe Threat Intelligence Features XSOAR-ENGINEER Practice Questions (Page 4)

Part of the Threat Intelligence Management domain, which accounts for 18% of the XSOAR-ENGINEER exam.

26questions here

6free pages

7concepts

18%of the exam

Questions 16–20

16foundation · easy
What is the primary purpose of threat intelligence enrichment in Cortex XSOAR?
Select an answer first
17application · medium
An analyst is investigating an incident and wants to enrich a suspicious domain with data from VirusTotal and WHOIS. They want the enrichment results to be stored on the indicator for future reference. What should they do?
Select an answer first
18foundation · easy
Which XSOAR feature is commonly used to perform automatic enrichment of indicators during incident handling?
Select an answer first
19expert · hard
A threat intelligence team needs to share a subset of indicators with a partner. The partner only wants indicators that are related to a specific campaign and have a confidence score above 70. The indicators are stored in XSOAR with custom fields for campaign and confidence. What is the most efficient way to export only the relevant indicators?
Select an answer first
20application · medium
A threat intelligence team has curated a set of high-confidence indicators in XSOAR and wants to share them with a partner organization that uses a different threat intelligence platform. The partner can consume STIX 2.1. What is the most appropriate way to export the indicators?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XSOAR-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSOAR-ENGINEER” is a trademark of its owner, used for identification only.

5.1 Identify and Describe Threat Intelligence Features XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

What is the primary purpose of threat intelligence enrichment in Cortex XSOAR?

An analyst is investigating an incident and wants to enrich a suspicious domain with data from VirusTotal and WHOIS. They want the enrichment results to be stored on the indicator for future reference. What should they do?

Which XSOAR feature is commonly used to perform automatic enrichment of indicators during incident handling?

A threat intelligence team has curated a set of high-confidence indicators in XSOAR and wants to share them with a partner organization that uses a different threat intelligence platform. The partner can consume STIX 2.1. What is the most appropriate way to export the indicators?

Keep studying — Threat Intelligence Management