Palo Alto Networks Certified Security Automation Engineer (PCSAE)Automation and OrchestrationEasy
A security operations team is implementing an automated threat intelligence ingestion workflow in Cortex XSOAR. They need to ensure that incoming threat feeds are automatically parsed, enriched, and correlated with existing indicators of compromise (IOCs) before being added to the platform's threat intelligence repository. Which Cortex XSOAR feature is primarily responsible for performing these actions on newly ingested threat data?
- AThreat Intelligence Management (TIM) Playbooks
- BIncident Layouts
- CWar Room Chat
- DDashboard Widgets
Show answer & explanationAnswer & explanation
Correct answer: A. Threat Intelligence Management (TIM) Playbooks
Threat Intelligence Management (TIM) Playbooks are specifically designed to automate the processing, enrichment, and correlation of threat intelligence, ensuring that new data is properly integrated and actionable within Cortex XSOAR.
Why the other options are wrong
- B. Incident Layouts define the structure and display of incident data, not the processing of threat feeds.
- C. War Room Chat is a collaboration tool for incident response, not for automated threat intelligence processing.
- D. Dashboard Widgets are for visualizing data, not for automating data ingestion and enrichment workflows.
TIM Playbooks
Automated workflows in Cortex XSOAR specifically designed to manage and process threat intelligence lifecycle, from ingestion and parsing to enrichment and correlation.
- Automate threat feed processing.
- Perform enrichment and correlation.
- Integrate new IOCs into the platform.
Memory trick: PLAY-books make Threat Intelligence Smart and Ready.