Examkin

Question

Difficulty: EasyThreat Intelligence Sources and Research

A junior security analyst is tasked with setting up an automated, machine-readable threat intelligence feed to deliver standardized cyber threat indicators directly into the organization's Security Information and Event Management (SIEM) system over HTTPS. Which of the following standards and transport protocols should the analyst implement to achieve this? (Select TWO.)

  1. STIX (Structured Threat Information Expression)Answer
  2. TAXII (Trusted Automated Exchange of Intelligence Information)Answer
  3. C
    CVE (Common Vulnerabilities and Exposures)
  4. D
    RADIUS (Remote Authentication Dial-In User Service)
  5. E
    OSINT (Open-Source Intelligence)

Answer

STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) should be implemented.
STIX defines the standardized structured language to describe threat data (what is being shared), while TAXII defines the secure transport protocol over HTTPS to automate the exchange of that data between systems (how it is delivered). Together, STIX and TAXII enable automated threat intelligence ingestion into SIEM platforms.

Step-by-Step Solution

1
Identify the requirement for standardized threat indicator data formatting.
STIX provides a structured format (JSON/XML schema) to represent threat intelligence indicators consistently across systems.
Machine-readable formats ensure SIEMs can parse threat data without manual intervention.
2
Identify the protocol mechanism required for secure automated transport over HTTPS.
TAXII defines the web service specifications and HTTPS-based message exchange protocol specifically designed for sharing CTI.
TAXII handles the secure delivery of STIX-formatted threat intelligence.

Key Concept

Automated Threat Intelligence Ingestion (STIX/TAXII)
Rate this question

Topics

Threat Intelligence Sources and Research

More questions from this topic