Which two relationships are commonly auto-generated during enrichment? (Choose two)

The correct answer is A. IP -> Domain C. File Hash -> Malware Family. During enrichment in threat intelligence and SOAR platforms, external data sources automatically resolve IP addresses to associated domains (via passive DNS, WHOIS, etc.) and file hashes to malware families (via feeds like VirusTotal or threat intel platforms), making A and C…

Threat Intelligence Management

Question

Options

AIP -> Domain
BURL -> Incident Owner
CFile Hash -> Malware Family
DRole -> Dashboard Widget
EPlaybook -> Indicator

How the community answered

(36 responses)

A
89% (32)
B
3% (1)
D
3% (1)
E
6% (2)

Explanation

During enrichment in threat intelligence and SOAR platforms, external data sources automatically resolve IP addresses to associated domains (via passive DNS, WHOIS, etc.) and file hashes to malware families (via feeds like VirusTotal or threat intel platforms), making A and C the two canonical auto-generated relationships. These are data-driven lookups that happen without analyst input when an observable is submitted for enrichment.

Why the distractors are wrong:

B (URL -> Incident Owner): "Incident Owner" is an assignment/workflow field set by a human or assignment rule, not a product of data enrichment.
D (Role -> Dashboard Widget): This describes a UI/RBAC configuration relationship, entirely unrelated to enrichment pipelines.
E (Playbook -> Indicator): A playbook processes indicators but doesn't create an enrichment relationship with them - it's an execution/automation concept.

Memory tip: Think "IOC enrichment pairs" - the two classic enrichable IOCs are network (IP resolves to Domain) and file (Hash classifies to Malware Family). Everything else in the list involves people, UI, or workflows, which are never generated by enrichment.

Topics

#indicator relationships#enrichment#IP to domain#file hash to malware

Community Discussion

No community discussion yet for this question.

Full XSOAR-ENGINEER Practice