During an investigation, an analyst runs the reputation script for an indicator that is listed as Suspicious. The new reputation results display in the War Room as Malicious; however, the indicator…

The correct answer is B. The indicator verdict was manually set to Suspicious. A manually assigned verdict locks the indicator's status; automated reputation updates (like the script result showing Malicious) do not override a manual verdict, so it remains Suspicious.

Threat Intelligence Management

Question

During an investigation, an analyst runs the reputation script for an indicator that is listed as Suspicious. The new reputation results display in the War Room as Malicious; however, the indicator verdict does not change. What is the cause of this behavior?

Options

AThe indicator is expired.
BThe indicator verdict was manually set to Suspicious.
CThe indicator has been excluded.
DThe indicator exists as an IOC rule.

How the community answered

(42 responses)

A
5% (2)
B
83% (35)
C
10% (4)
D
2% (1)

Explanation

A manually assigned verdict locks the indicator's status; automated reputation updates (like the script result showing Malicious) do not override a manual verdict, so it remains Suspicious.

Topics

#indicator verdict#manual verdict override#reputation script#War Room

Community Discussion

No community discussion yet for this question.

Full XSIAM-ANALYST Practice