Which type of IOC can you define in Cortex XDR?

The correct answer is A. Destination IP Address. Cortex XDR allows you to define IOC rules based on various types of indicators of compromise (IOC) that you can use to detect and respond to threats in your network. One of the types of IOC that you can define in Cortex XDR is destination IP address, which is the IP address of…

Threat Intelligence and IOC Management

Question

Options

ADestination IP Address
BSource IP Address
CSource port
DDestination IP Address: Destination

How the community answered

(38 responses)

A
71% (27)
B
16% (6)
C
8% (3)
D
5% (2)

Explanation

Cortex XDR allows you to define IOC rules based on various types of indicators of compromise (IOC) that you can use to detect and respond to threats in your network. One of the types of IOC that you can define in Cortex XDR is destination IP address, which is the IP address of the remote host that a local endpoint is communicating with. You can use this type of IOC to identify malicious network activity, such as connections to command and control servers, phishing sites, or malware distribution hosts. You can also specify the direction of the network traffic (inbound or outbound) and the protocol (TCP or UDP) for the destination IP address IOC.

Topics

#IOC#destination IP address#indicators of compromise#threat intelligence

Community Discussion

No community discussion yet for this question.

Full XDR-ANALYST Practice