Palo Alto Networks Certified Security Automation Engineer (PCSAE)Automation and OrchestrationMedium
An organization is implementing a new threat intelligence platform (TIP) to consolidate various open-source and commercial feeds. They want to ensure that newly identified indicators of compromise (IOCs) from these feeds are automatically ingested into Cortex XSOAR, de-duplicated, enriched with additional context (e.g., malware family, confidence score), and then pushed to their firewalls and EDR solutions for proactive blocking. Which Cortex XSOAR capability is essential for orchestrating this end-to-end process?
- AThreat Intelligence Management Pack
- BCompliance Automation Dashboards
- CSecurity Operations Center (SOC) Playbooks
- DVulnerability Management Scanners
Show answer & explanationAnswer & explanation
Correct answer: A. Threat Intelligence Management Pack
The Threat Intelligence Management Pack in Cortex XSOAR is specifically designed to centralize, process, enrich, and distribute threat intelligence from various sources to enforcement points, directly addressing all requirements of the scenario.
Why the other options are wrong
- B. Compliance Automation Dashboards are for reporting on regulatory adherence, not managing threat intelligence feeds.
- C. While SOC Playbooks might use threat intelligence, the 'Threat Intelligence Management Pack' is the dedicated solution for the end-to-end lifecycle described.
- D. Vulnerability Management Scanners identify system weaknesses, which is unrelated to threat intelligence processing and distribution.
Threat Intelligence Management Pack
A specialized Cortex XSOAR content pack designed to automate the ingestion, processing, enrichment, and distribution of threat intelligence from various sources.
- Centralizes IOCs from multiple feeds.
- Automates deduplication and enrichment of threat data.
- Facilitates proactive blocking by pushing IOCs to enforcement tools.
Memory trick: Threat Intel Pack: Feed, Enrich, Defend.