Question

A SOC analyst receives the following API response body while integrating a threat intelligence feed into a SOAR playbook:

{
  "indicators": [
    { "value": "198.51.100.5", "type": "ipv4", "confidence": 85 },
    { "value": "evil.example.com", "type": "domain", "confidence": 60 }
  ],
  "count": 2
}

Based on the structure of this data, which statement most accurately describes the format so the analyst can select the correct parsing approach in the playbook?

Accepted Answer

It is JSON, using key-value pairs with an array of nested objects that can be accessed by keys such as indicators[0].value

Answer

It is XML, using opening and closing tags to define a hierarchy of elements

Answer

It is CSV, using delimiters to separate rows and columns of flat tabular data

Answer

It is HTML, using markup tags intended to render structured content in a browser