A feed has the highest configured reliability; however, even when it sets an indicator as suspicious or benign, it has a different final verdict in Cortex XSOAR. Based on the image below, what could…

The correct answer is A. Indicator Reputation from the feed is set to "Malicious.". Even if a feed has the highest Source Reliability, the final verdict of an indicator in Cortex XSOAR is still influenced by the Indicator Reputation setting. In the screenshot, the feed is configured to always assign Malicious reputation. This will override less severe verdicts…

Threat Intelligence and Indicator Management

Question

A feed has the highest configured reliability; however, even when it sets an indicator as suspicious or benign, it has a different final verdict in Cortex XSOAR. Based on the image below, what could be the reason for this behavior?

Exhibit

Options

AIndicator Reputation from the feed is set to "Malicious."
BSource Reliability needs to be increased to "A - Completely reliable."
CThe Indicator Expiration Method needs to be set to "Never Expire."
DThe Traffic Light Protocol Color is empty.

How the community answered

(40 responses)

A
65% (26)
B
5% (2)
C
20% (8)
D
10% (4)

Explanation

Even if a feed has the highest Source Reliability, the final verdict of an indicator in Cortex XSOAR is still influenced by the Indicator Reputation setting. In the screenshot, the feed is configured to always assign Malicious reputation. This will override less severe verdicts (such as Suspicious or Benign) from the feed, which explains why the final verdict may not match the feed's original

Topics

#indicator reputation#feed reliability#indicator verdict#feed integration

Community Discussion

No community discussion yet for this question.

Full XSOAR-ENGINEER Practice