A security operations center wants lists of known malicious IP addresses and domains to be ingested automatically into its SIEM and firewall block lists as they are updated. What should the SOC subscribe to?
Select an answer to reveal the explanation.
Short Explanation
A threat feed is like a news ticker that your tools can read on their own. Bad IPs and domains stream in, and your SIEM and firewall act on them without you copying anything by hand. Reports are great reading, but machines can't act on a PDF.
Full Explanation
Threat feeds are continuously updated streams of indicators of compromise, such as malicious IP addresses, domains, URLs, and file hashes, delivered in machine-readable formats that security tools can consume automatically. A SIEM can correlate events against feed indicators, and firewalls or secure web gateways can import them into block lists, reducing the time between discovery of a malicious resource and enforcement. Feeds may be commercial, open source, or shared through industry groups, and they should be evaluated for accuracy and timeliness to avoid blocking legitimate traffic. A monthly CVE report from a vulnerability scanner describes software weaknesses; it helps prioritize patching but does not provide attacker infrastructure to block. An annual threat landscape report offers strategic context about trends and actors, which informs planning but is neither timely nor machine-consumable. A CVSS calculator scores vulnerability severity; it has no indicators of malicious infrastructure at all. Exam caveat: threat feeds are tactical and operational intelligence, while reports and briefings are strategic; questions often contrast automated consumption with human-readable analysis. Operational check: confirm the feed's format is supported by the SIEM and firewall, set an expiration for indicators so stale entries age out, and monitor for false positives after each feed update.