300-710 · Question #247
A security engineer must integrate an external feed containing STIX/TAXII data with Cisco FMC. Which feature must be enabled on the Cisco FMC to support this connection?
The correct answer is C. Threat Intelligence Director. Threat Intelligence Director (TID) is the Cisco FMC feature designed to integrate external threat intelligence feeds, including those using STIX/TAXII formats, into the security posture.
Question
A security engineer must integrate an external feed containing STIX/TAXII data with Cisco FMC. Which feature must be enabled on the Cisco FMC to support this connection?
Options
- ACisco Success Network
- BCisco Secure Endpoint Integration
- CThreat Intelligence Director
- DSecurity Intelligence Feeds
How the community answered
(46 responses)- A2% (1)
- B9% (4)
- C87% (40)
- D2% (1)
Why each option
Threat Intelligence Director (TID) is the Cisco FMC feature designed to integrate external threat intelligence feeds, including those using STIX/TAXII formats, into the security posture.
Cisco Success Network is related to product support and telemetry, not direct threat intelligence integration.
Cisco Secure Endpoint Integration is for connecting FMC with endpoint security solutions, not for ingesting external threat intelligence feeds like STIX/TAXII.
Threat Intelligence Director (TID) in Cisco FMC allows for the consumption, aggregation, and actioning of threat intelligence from various sources, including open standards like STIX/TAXII. This feature enables the FMC to ingest Indicators of Compromise (IoCs) and apply them to security policies for enhanced detection and prevention.
Security Intelligence Feeds are a type of intelligence, but Threat Intelligence Director is the specific FMC feature that manages and integrates these feeds, including STIX/TAXII.
Concept tested: Integrating external threat intelligence with FMC
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/tid-overview.html
Topics
Community Discussion
No community discussion yet for this question.