nerdexam
Palo_Alto_Networks

XSIAM-ANALYST · Question #5

While investigating an alert, an analyst notices that a URL indicator has a related alert from a previous incident. The related alert has the same URL, but it resolved to a different IP address…

The correct answer is C. Remove the relationship between the URL and the older IP address. D. Enrich the URL indicator. Removing the outdated URL-IP relationship clears the incorrect linkage, and enriching the URL indicator updates it with the current resolution and context so future alerts reflect the right

Threat Intelligence Management

Question

While investigating an alert, an analyst notices that a URL indicator has a related alert from a previous incident. The related alert has the same URL, but it resolved to a different IP address. Which combination of two actions should the analyst take to resolve this issue? (Choose two.)

Options

  • AEnrich the IP address indicator associated with the previous alert.
  • BExpire the URL indicator.
  • CRemove the relationship between the URL and the older IP address.
  • DEnrich the URL indicator.

How the community answered

(27 responses)
  • A
    7% (2)
  • B
    15% (4)
  • C
    78% (21)

Explanation

Removing the outdated URL-IP relationship clears the incorrect linkage, and enriching the URL indicator updates it with the current resolution and context so future alerts reflect the right

Topics

#indicator enrichment#URL indicator#indicator relationships#threat intelligence

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full XSIAM-ANALYST Practice