300-215 Question 228
Select 2You are investigating a sophisticated malware campaign targeting your organization. A threat intelligence feed provides actionable data in STIX format through a TAXII server. How can you effectively use this data in your investigation to identify Indicators of Compromise (IoCs)?
- A
Import the STIX data into Cisco Secure Endpoint to automatically block identified IoCs.
- B
Use Cisco Threat Response to ingest the STIX data via the TAXII server and correlate it with existing telemetry.
- C
Manually parse the STIX file using a text editor to extract IoCs and add them to your firewall manually.
- D
Leverage Cisco SecureX to integrate the STIX data with other security tools for cross-platform analysis.
- E
Convert the STIX format into a JSON file manually for compatibility with Cisco security tools.
Show answer and explanation
Correct answers: B, D
Explanation
STIX and TAXII are standardized formats for sharing threat intelligence. Cisco Threat Response can ingest threat intelligence in STIX format via TAXII servers and correlate it with your existing data, while Cisco SecureX enables integration and analysis across multiple platforms. These capabilities facilitate streamlined IoC identification and response. Manual processes or unnecessary data conversions are inefficient and not aligned with best practices.
- A. Incorrect.
Cisco Secure Endpoint does not directly process STIX data for blocking IoCs. This requires prior ingestion and correlation via other tools like SecureX or Threat Response.
- B. Correct.
Cisco Threat Response supports ingesting threat intelligence data via TAXII servers and can correlate the data with your organization's existing telemetry for better incident investigation.
- C. Incorrect.
Manually parsing STIX data is inefficient and prone to errors. Automation using tools like SecureX or Threat Response is recommended to handle such structured threat intelligence data.
- D. Correct.
Cisco SecureX can integrate threat intelligence in STIX format with other tools, allowing for comprehensive cross-platform analysis and faster incident response.
- E. Incorrect.
Manually converting STIX into JSON is unnecessary, as Cisco tools like Threat Response and SecureX natively support STIX and TAXII formats for ingesting threat intelligence.