Question

A SOC analyst receives a threat intelligence feed export and needs to identify its format before writing a parser. The file contains the following content:

indicator,type,confidence,first_seen
185.220.101.5,ip,90,2024-01-15
malware.example.com,domain,75,2024-01-16
d41d8cd98f00b204,hash,60,2024-01-17

Which data format is this, and what characteristic confirms it?

Accepted Answer

CSV, because it is a flat structure with a header row and comma-delimited fields, one record per line

Answer

JSON, because the data is organized into key-value pairs enclosed in braces

Answer

XML, because each record is wrapped in nested opening and closing tags

Answer

YAML, because indentation and colons define the hierarchy of each field