Palo Alto Networks Certified Security Automation Engineer (PCSAE)Automation and OrchestrationHard
A SOC team is struggling to keep up with the volume of daily threat intelligence reports. They want to automate the extraction of new indicators of compromise (IOCs) from various PDF and email reports, normalize the data, and then automatically block these IOCs on their perimeter firewalls. Which Cortex XSOAR integration type is most suitable for extracting data from unstructured text documents like PDFs and emails?
- AGeneric API Integrations
- BOptical Character Recognition (OCR) and Natural Language Processing (NLP) Integrations
- CSIEM Integrations
- DThreat Intelligence Feed Integrations
Show answer & explanationAnswer & explanation
Correct answer: B. Optical Character Recognition (OCR) and Natural Language Processing (NLP) Integrations
To extract IOCs from unstructured text documents like PDFs and emails, Cortex XSOAR requires integrations with OCR for converting images of text into machine-readable text, and NLP for parsing and extracting meaningful entities (like IOCs) from that text. Generic API integrations or dedicated TI feeds are for structured data, and SIEM integrations are for structured logs.
Why the other options are wrong
- A. Generic API integrations are for structured data exchange, not parsing unstructured text.
- C. SIEM Integrations are specifically for ingesting security event logs, which are structured data.
- D. Threat Intelligence Feed Integrations are for consuming structured or semi-structured feeds, not for extracting from free-form documents.
Unstructured Data Extraction (XSOAR)
The process of using specialized integrations (like OCR and NLP) within Cortex XSOAR to automatically extract meaningful information, such as IOCs, from free-form text documents, PDFs, or emails.
- Transforms unreadable or free-form text into structured data.
- Leverages AI/ML capabilities for entity recognition.
- Crucial for automating threat intelligence from human-readable reports.
Memory trick: OCR and NLP read the reports, find the IOCs.