300-215 Question 224
Select 3A security analyst is investigating a ransomware incident in the network. During the investigation, the analyst receives threat intelligence data in STIX format from a third-party vendor and accesses a TAXII server for additional intelligence. What should the analyst focus on to effectively utilize the received threat intelligence for this investigation?
- A
Extract indicators of compromise (IOCs) from the STIX file and cross-reference them with network logs.
- B
Analyze the TAXII server data for automated threat sharing and correlation with the current incident.
- C
Manually convert the STIX data into plain text for easier readability.
- D
Use a SIEM tool to import and analyze both STIX and TAXII data for actionable insights.
- E
Rely only on the STIX data, as TAXII is not relevant to this type of investigation.
Show answer and explanation
Correct answers: A, B, D
Explanation
STIX and TAXII are complementary standards designed to share and analyze threat intelligence effectively. By extracting IOCs from STIX, leveraging TAXII for automated sharing and retrieval, and using SIEM tools for analysis, the analyst can gain comprehensive insights into the ongoing ransomware incident. Ignoring either standard or relying on manual conversion would reduce the efficiency and depth of the investigation.
- A. Correct.
STIX provides a structured format for threat intelligence, including IOCs, which can be cross-referenced with network logs to identify potential matches related to the incident.
- B. Correct.
TAXII facilitates automated sharing and retrieval of threat intelligence data. Analyzing this data can help correlate information with the current incident for a broader understanding.
- C. Incorrect.
Manually converting STIX data into plain text is unnecessary and counterproductive, as tools exist to parse and analyze the structured data effectively.
- D. Correct.
SIEM tools can import and analyze STIX and TAXII data, enabling the analyst to derive actionable insights by correlating threat intelligence with events in the network.
- E. Incorrect.
TAXII is relevant for retrieving and sharing structured threat intelligence. Ignoring TAXII data would limit the scope of analysis.