XSOAR-ENGINEER · Question #18
What is the primary effect on a new file hash when it is added to the indicator exclusion list?
The correct answer is A. It is not extracted, enriched, or given a new verdict. When a file hash is added to the indicator exclusion list in Cortex XSOAR, it is completely ignored during processing - meaning it will not be extracted, not enriched, and no verdict will be assigned. This ensures excluded indicators do not impact incident analysis or trigger…
Question
What is the primary effect on a new file hash when it is added to the indicator exclusion list?
Options
- AIt is not extracted, enriched, or given a new verdict.
- BIt is extracted and stored, but an "exclusion" tag is added, requiring manual review before it can
- CIt is processed normally by enrichment automations, but the verdict is set to "benign."
- DIt is excluded from intelligence feeds that have a reliability score lower than "B - Usually reliable."
How the community answered
(18 responses)- A94% (17)
- B6% (1)
Explanation
When a file hash is added to the indicator exclusion list in Cortex XSOAR, it is completely ignored during processing - meaning it will not be extracted, not enriched, and no verdict will be assigned. This ensures excluded indicators do not impact incident analysis or trigger playbooks.
Topics
Community Discussion
No community discussion yet for this question.