Palo_Alto_Networks
SECOPS-PRO · Question #3
A file hash is evaluated a Cortex XSOAR by using two unique threat feeds: - VirusTotal feed (rating of B- usually reliable) and the file verdict is malicious - AlienVault feed (rating of B- usually…
The correct answer is C. Unknown. Conflicting threat feed verdicts (malicious vs. benign) result in an "Unknown" verdict in Cortex XSOAR until further analysis resolves the conflict.
Incident Response
Question
A file hash is evaluated a Cortex XSOAR by using two unique threat feeds:
- VirusTotal feed (rating of B- usually reliable) and the file verdict
is malicious
- AlienVault feed (rating of B- usually reliable) and the file verdict
is benign What is the file verdict in XSOAR?
Options
- ABenign
- BMalicious
- CUnknown
- DSuspicious
How the community answered
(16 responses)- A6% (1)
- B6% (1)
- C75% (12)
- D13% (2)
Explanation
Conflicting threat feed verdicts (malicious vs. benign) result in an "Unknown" verdict in Cortex XSOAR until further analysis resolves the conflict.
Topics
#Cortex XSOAR#threat intelligence feeds#file verdict#indicator scoring
Community Discussion
No community discussion yet for this question.