Examkin

Soru

Zorluk: KolayThreat Intelligence Sources and Research

A junior security analyst is tasked with setting up an automated, machine-readable threat intelligence feed to deliver standardized cyber threat indicators directly into the organization's Security Information and Event Management (SIEM) system over HTTPS. Which of the following standards and transport protocols should the analyst implement to achieve this? (Select TWO.)

  1. STIX (Structured Threat Information Expression)Cevap
  2. TAXII (Trusted Automated Exchange of Intelligence Information)Cevap
  3. C
    CVE (Common Vulnerabilities and Exposures)
  4. D
    RADIUS (Remote Authentication Dial-In User Service)
  5. E
    OSINT (Open-Source Intelligence)

Cevap

STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) should be implemented.
STIX defines the standardized structured language to describe threat data (what is being shared), while TAXII defines the secure transport protocol over HTTPS to automate the exchange of that data between systems (how it is delivered). Together, STIX and TAXII enable automated threat intelligence ingestion into SIEM platforms.

Adım Adım Çözüm

1
Identify the requirement for standardized threat indicator data formatting.
STIX provides a structured format (JSON/XML schema) to represent threat intelligence indicators consistently across systems.
Machine-readable formats ensure SIEMs can parse threat data without manual intervention.
2
Identify the protocol mechanism required for secure automated transport over HTTPS.
TAXII defines the web service specifications and HTTPS-based message exchange protocol specifically designed for sharing CTI.
TAXII handles the secure delivery of STIX-formatted threat intelligence.

Anahtar Kavram

Automated Threat Intelligence Ingestion (STIX/TAXII)
Bu soruyu puanla

Konular

Threat Intelligence Sources and Research

Bu konudan daha fazla soru