Palo_Alto_Networks
SECOPS-PRO · Question #3
A file hash is evaluated a Cortex XSOAR by using two unique threat feeds: - VirusTotal feed (rating of B- usually reliable) and the file verdict is malicious - AlienVault feed (rating of B- usually re
The correct answer is C. Unknown. Conflicting threat feed verdicts (malicious vs. benign) result in an "Unknown" verdict in Cortex XSOAR until further analysis resolves the conflict.
Incident Response
Question
A file hash is evaluated a Cortex XSOAR by using two unique threat feeds:
- VirusTotal feed (rating of B- usually reliable) and the file verdict
is malicious
- AlienVault feed (rating of B- usually reliable) and the file verdict
is benign What is the file verdict in XSOAR?
Options
- ABenign
- BMalicious
- CUnknown
- DSuspicious
How the community answered
(16 responses)- A6% (1)
- B6% (1)
- C75% (12)
- D13% (2)
Explanation
Conflicting threat feed verdicts (malicious vs. benign) result in an "Unknown" verdict in Cortex XSOAR until further analysis resolves the conflict.
Topics
#Cortex XSOAR#threat intelligence feeds#file verdict#indicator scoring
Community Discussion
No community discussion yet for this question.