Palo Alto Networks Certified Security Automation Engineer (PCSAE)IntegrationsEasy
A security operations team is onboarding a new threat intelligence feed into Cortex XSOAR. The feed provides indicators in a custom JSON format via an HTTP endpoint. The team wants to periodically fetch these indicators, parse them, and automatically create or update corresponding indicators in Cortex XSOAR. Which type of integration should be used for this purpose?
- ACommand Integration
- BBidirectional Integration
- CFeed Integration
- DEvent Collector Integration
Show answer & explanationAnswer & explanation
Correct answer: C. Feed Integration
A Feed Integration in Cortex XSOAR is specifically designed for ingesting data (like indicators, observables, or reputation lists) from external sources on a scheduled basis. It includes mechanisms for fetching, parsing, and mapping external data into XSOAR's native indicator objects, making it the perfect choice for a threat intelligence feed.
Why the other options are wrong
- A. Command integrations execute specific actions on demand but are not designed for scheduled, continuous data ingestion.
- B. Bidirectional integrations typically involve both fetching data and pushing data to an external system, which is more than just a feed.
- D. Event Collector integrations are primarily for ingesting security events or alerts, not general threat intelligence indicators.
Feed Integration Type
A type of Cortex XSOAR integration designed for scheduled, one-way ingestion of data (e.g., indicators, observables) from external sources.
- Used for threat intelligence, reputation lists, etc.
- Fetches data periodically.
- Parses and maps external data to XSOAR indicators.
- Primarily one-way data flow into XSOAR.
Memory trick: Feeds are for feeding XSOAR with intelligence.