Palo Alto Networks Certified Security Automation Engineer (PCSAE)IntegrationsEasy
A security operations center (SOC) is onboarding a new threat intelligence feed into Cortex XSOAR. The feed provides indicators of compromise (IOCs) such as IP addresses, domains, and file hashes via an API endpoint that returns a list of new IOCs every 5 minutes. The SOC needs these IOCs to be automatically ingested into XSOAR and enriched. Which integration type is BEST suited for this scenario?
- AFeed integration
- BGeneric API integration
- CCustom playbook integration
- DCommand-line integration
Show answer & explanationAnswer & explanation
Correct answer: A. Feed integration
Feed integrations in Cortex XSOAR are specifically designed for continuous ingestion of Indicators of Compromise (IOCs) or other data from external sources at regular intervals. They automate the process of fetching, parsing, and creating indicators within XSOAR.
Why the other options are wrong
- B. A Generic API integration can fetch data, but it requires more manual configuration and playbook logic to continuously ingest and manage IOCs, making it less efficient than a dedicated feed integration.
- C. A custom playbook integration is not a type of integration; playbooks orchestrate actions, often using existing integrations. While a playbook might use a feed integration, it's not the integration type itself.
- D. A command-line integration is used for executing external scripts or tools, not for continuous, scheduled data ingestion from an API.
Feed Integration Type
A Cortex XSOAR feed integration is a specialized integration type designed for automated, periodic ingestion of external data (e.g., IOCs, threat intelligence) into XSOAR indicators or other data structures.
- Automates periodic data fetching.
- Ideal for threat intelligence and IOCs.
- Creates and updates XSOAR indicators.
- Configurable fetch intervals and mapping.
Memory trick: Feeds are for continuous flows of fresh intel.