XSOAR-ENGINEER · Question #32
Two feed integrations with the same source reliability (B - Usually reliable) fetch the same indicator with the following verdicts: - Integration A - Malicious - Integration B - Benign Indicator…
The correct answer is D. Verdict: Benign. When two feeds with the same reliability provide conflicting verdicts, the most recently fetched verdict becomes the current verdict. Since Integration B was fetched after Integration A, the indicator's verdict will be Benign, and its other field values will also reflect…
Question
Two feed integrations with the same source reliability (B - Usually reliable) fetch the same indicator with the following verdicts:
- Integration A - Malicious
- Integration B - Benign
Indicator data from Integration B was fetched after Integration A. What will be the values of the fields associated with the indicator?
Options
- AVerdict: Malicious
- BVerdict: Malicious
- CVerdict: Benign
- DVerdict: Benign
How the community answered
(52 responses)- A6% (3)
- B23% (12)
- C10% (5)
- D62% (32)
Explanation
When two feeds with the same reliability provide conflicting verdicts, the most recently fetched verdict becomes the current verdict. Since Integration B was fetched after Integration A, the indicator's verdict will be Benign, and its other field values will also reflect Integration B.
Topics
Community Discussion
No community discussion yet for this question.