During a post-incident review of a successful ransomware attack, the incident response team identifies that initial alerts were generated but deprioritized due to an 'Information' severity classification. Analysis reveals the alerts, while individually low-fidelity, collectively pointed to a reconnaissance phase followed by credential access on a critical server. What adjustment to the incident categorization and prioritization framework would be most effective in preventing similar oversights?

• A. Increase the threshold for all network-based alerts by 50% to reduce false positives and focus only on high-severity alerts.
• B. Implement an automated system to escalate any 'Information' level alert to 'Low' severity after 24 hours, regardless of context.
• C. Mandate manual review of all 'Information' severity alerts by a Tier 1 SOC analyst within 1 hour of generation.
• D. Develop correlation rules in the SIEM (e.g., Splunk, QRadar) or SOAR (e.g., XSOAR) to elevate incident severity based on sequences of related low-severity events targeting high-value assets.
• E. Categorize all alerts related to critical servers as 'High' severity by default, irrespective of the initial detection's confidence level.

A Security Operations Center (SOC) using Cortex XDR observes a high-severity alert indicating a potential ransomware attack.
The alert details include a specific file hash (SHA256:
e3bOc44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855) associated with a suspicious process.
Which of the following Cortex XDR and Cortex XSOAR capabilities would be most effective in leveraging this file indicator for rapid investigation and containment?

• A. Configuring a custom 'Exclusion' in Cortex XDR for this specific file hash to prevent future alerts.
• B. Submitting the file hash to the public VirusTotal API and awaiting a community verdict before taking action.
• C. Automatically querying AutoFocus for intelligence on the file hash to determine its reputation and associated campaigns, then blocking it via WildFire.
• D. Leveraging a Cortex XSOAR playbook to initiate a 'War Room' discussion with the incident response team.
• E. Using the file hash in a Cortex XDR 'Live Terminal' session to remotely delete the suspicious file from affected endpoints.

You are a lead security engineer at a large enterprise, tasked with optimizing the organization's threat intelligence pipeline for maximum effectiveness against polymorphic malware and advanced persistent threats (APTs). The current setup primarily relies on basic SIEM correlation and generic firewall rules. Your goal is to implement a solution that provides real-time, context- rich intelligence, automates detection of unknown threats, and enables proactive defense. Which of the following architectural and operational decisions would be most aligned with achieving these objectives?

• A. Purchase an open-source sandbox solution and develop custom Python scripts to parse its output into STIX/TAXII formats for ingestion into a generic firewall, avoiding proprietary solutions.
• B. Integrate all network logs with VirusTotal's public API for continuous hash lookups, and manually update firewall rules based on any new detections.
• C. Deploy Palo Alto Networks NGFWs with integrated WildFire cloud subscription for automated unknown file analysis and immediate signature distribution; subscribe to Unit 42's premium threat intelligence feeds for contextualized insights and adversary TTPs, and integrate these feeds into your SIEM for enhanced correlation and alerting.
• D. Focus exclusively on endpoint protection platforms (EPPs) with AI-driven behavioral analysis, as network-level threat intelligence is becoming less relevant for advanced threats.
• E. Implement an extensive honeypot network to capture malware samples, then manually analyze them and submit hashes to VirusTotal for public validation.

A security analyst is tuning Cortex XDR after a custom application, which uses the mshta.exe utility with a legitimate internal script, triggers a behavioral threat alert. The administrator must ensure the legitimate script runs without detection. Which set of criteria must be included in the new exception rule to prevent future false positives while maintaining protection against similar malicious activity?

• A. File name hash (SHA256) of the mshta.exe file
• B. Signature or signer of the mshta.exe binary
• C. Exception based on the process path and script command-line arguments
• D. Alert exclusion that is based on the name of the threat