Option A (Correct): IOC rules within Cortex XSIAM can detect specific indicators such as files, registry keys, IP addresses, hashes, and URLs.
Option D (Correct): IOC rules can indeed be uploaded or updated programmatically using REST APIs, enabling automation and bulk management.
Options B and C are incorrect due to the following reasons:
Expiration dates for IOC rules vary depending on system settings, and there is no strict 180-day limit explicitly defined in the provided documentation.
IOC rules are managed through general alert exclusion mechanisms as well as through suppression rules.
"IOC rules can detect specific files, hashes, registry keys, IP addresses, and URLs and can be managed programmatically via REST API."
Exact Page:Page 33 (Alerting and Detection section)
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit