XSOAR-ENGINEER · Question #40
A playbook loop that interacts with Active Directory for user details (yielding extensive data) is altered to extract newly acquired indicators of compromise (IOCs). This change results in two critica
The correct answer is B. Set ad-get-user indicator extraction mode to None.. The ad-get-user task returns extensive data, and with Indicator Extract Mode set to Inline, it automatically extracts large numbers of IOCs. This behavior triggers: - Massive indicator extraction, leading to rate limits on reputation services, and - Overloaded incidents with hund
Question
A playbook loop that interacts with Active Directory for user details (yielding extensive data) is altered to extract newly acquired indicators of compromise (IOCs). This change results in two critical issues:
- Rate limits being hit on integrated reputation services
- Incidents associated with hundreds of indicators
Given the settings below, what would prevent the issues in this use case? Incident Type: AD-Analysis Extract Indicators on Incident Creation: Use System Default (None) Extract Indicators on Field Change: Inline Task 1: ad-get-user Mark results as note: False Indicator Extract Mode: Inline Quiet Mode: False Task 2: ad-disable-account Mark results as note: True Indicator Extract Mode: None Quiet Mode: True Task 3: servicenow-update-Lickel. Mark results as note: False Indicator Extract Mode: Use System Default Quiet Mode: False
Options
- ASetAD-Analysis incident creation extraction to "Extract specific indicators."
- BSet ad-get-user indicator extraction mode to None.
- CSet servicenow-update-ticket indicator extraction mode to Inline.
- DDisable the feature that allows marking task outputs as notes.
How the community answered
(51 responses)- A14% (7)
- B47% (24)
- C8% (4)
- D31% (16)
Explanation
The ad-get-user task returns extensive data, and with Indicator Extract Mode set to Inline, it automatically extracts large numbers of IOCs. This behavior triggers: - Massive indicator extraction, leading to rate limits on reputation services, and - Overloaded incidents with hundreds of indicators. To prevent these issues, the correct approach is to disable indicator extraction for this task by setting its Indicator Extract Mode to None. This avoids unnecessary parsing of large datasets that aren't meant to be treated as IOCs.
Topics
Community Discussion
No community discussion yet for this question.