If a known malicious domain is no longer associated with a specific IP address, which action will make the association inactive?

The correct answer is A. Revoke the relationship. In Cortex XSOAR, when an indicator (such as a domain) is no longer associated with another (such as an IP), the correct way to make the association inactive is to revoke the relationship. This action preserves historical context but marks the relationship as no longer valid.

Threat Intelligence Management

Question

Options

ARevoke the relationship.
BUpdate the relationship type.
CExpire the IP address indicator.
DUpdate the indicator relationship description.

How the community answered

(63 responses)

A
90% (57)
B
2% (1)
C
5% (3)
D
3% (2)

Explanation

In Cortex XSOAR, when an indicator (such as a domain) is no longer associated with another (such as an IP), the correct way to make the association inactive is to revoke the relationship. This action preserves historical context but marks the relationship as no longer valid.

Topics

#indicator relationships#relationship revocation#domain indicators#threat intelligence

Community Discussion

No community discussion yet for this question.

Full XSOAR-ENGINEER Practice