5.1 Identify and Describe Threat Intelligence Features XSOAR-ENGINEER Practice Questions (Page 6)

Questions 26–26

1. 26application · medium

   A security operations team uses XSOAR to manage indicators. They notice that a known malicious domain is not triggering any alerts because its reputation score is 'Unknown'. The team wants to ensure that indicators with a reputation of 'Unknown' are automatically escalated for manual review without changing the threshold for other reputation levels. What should they configure?

   • AModify the default indicator score to 0 for all new indicators
   • BEnable the 'Auto-Enrich' option for all indicators with reputation 'Unknown'
   • CCreate a playbook that triggers on indicator reputation 'Unknown' and routes it to a manual review queue
   • DSet the 'Unknown' reputation threshold to a higher value in the indicator reputation settings
   Reveal Solution Discussion Select an answer first