Question

A SOC engineer writes a Python client that queries a threat-intelligence REST API for indicators matching a submitted hash. When the engineer submits a hash that the platform does not track, the API returns an HTTP status of 200 with a body of '[]' (an empty JSON array). The engineer's script currently treats any 200 response as 'indicator found and enriched' and creates a case. What is the correct interpretation of this response, and what should the script do?

Accepted Answer

The 200 status confirms the request succeeded, but the empty array body means no indicators matched; the script must inspect the body and skip case creation when the array is empty

Answer

The 200 status indicates the resource was created; the script is correct to create a case for every 200 response

Answer

A 200 with an empty body is actually an error condition and should be handled identically to a 404, so the script should retry the request

Answer

The empty array means the server timed out mid-query; the script should resend the request with a longer timeout value