312-39 · Question #14
A large financial institution has identified a sophisticated phishing campaign targeting employees, resulting in unauthorized access to sensitive customer data. The organization already uses a SIEM…
The correct answer is B. Integrate XDR with XSOAR. Integrating XDR with XSOAR best meets the combined goals of real-time correlation and streamlined response workflows. XDR’s strength is cross-domain detection and correlation (identity, endpoint, email, cloud, network) to produce higher-fidelity incidents from noisy…
Question
A large financial institution has identified a sophisticated phishing campaign targeting employees, resulting in unauthorized access to sensitive customer data. The organization already uses a SIEM for log aggregation and alerting, alongside an EDR solution for endpoint visibility. Additionally, they have access to XDR for broader threat detection and XSOAR for security orchestration and automation. As a SOC analyst, you’ve been asked to recommend an integration strategy to improve real-time threat correlation, streamline incident response workflows, and maximize the use of existing tools. Which integration would meet these goals?
Options
- AIntegrate XDR with SIEM
- BIntegrate XDR with XSOAR
- CIntegrate EDR with SIEM
- DIntegrate EDR with XSOAR
How the community answered
(16 responses)- A6% (1)
- B69% (11)
- C19% (3)
- D6% (1)
Explanation
Integrating XDR with XSOAR best meets the combined goals of real-time correlation and streamlined response workflows. XDR’s strength is cross-domain detection and correlation (identity, endpoint, email, cloud, network) to produce higher-fidelity incidents from noisy signals-critical in phishing- driven compromises. XSOAR’s strength is orchestrating response: enrichment, case management, approvals, containment actions (disable account, revoke sessions, isolate device), and notifications, all executed consistently through playbooks. When integrated, detections produced by XDR can automatically trigger XSOAR playbooks that standardize triage and containment, reducing response time and analyst workload while improving consistency and auditability. Integrating XDR with SIEM improves centralized visibility and correlation inside the SIEM, but it does not directly address end- to-end automated workflows. EDR integrations (with SIEM or XSOAR) are narrower in scope-useful for endpoint actions but less effective for phishing campaigns that span identity, email, and cloud resources. Since the question explicitly requires both improved correlation and streamlined response automation, XDR-to-XSOAR is the most complete option among those provided.
Topics
Community Discussion
No community discussion yet for this question.