What is a common way to enrich incident data in Splunk SOAR?

• A. By using internal email communication
• B. By integrating threat intelligence feeds
• C. By creating custom alerts
• D. By sharing it on public forums

Answer: (B)

Enriching incident data is critical in Splunk SOAR, as it enhances the context and insights related to security incidents. Integrating threat intelligence feeds is considered a common and effective method for this enrichment. Threat intelligence feeds provide valuable information about known threats, vulnerabilities, and indicators of compromise (IOCs). This additional context helps security teams to quickly assess and respond to incidents by correlating the incident with existing threats and understanding potential impacts or next steps in the mitigation process.

Using internal email communication, while useful for collaboration, does not directly enhance the quality or depth of the incident data. Creating custom alerts can help detect incidents but does not provide external context or enrichment to ongoing incidents. Sharing information on public forums may lead to risk exposure and does not contribute positively to enriching incident data within a controlled security environment.