Cisco Threat Intelligence Director STIX Process
Describe security intelligence authoring, sharing, and consumption
Answer
Correct answer: B — Sharing uses STIX to allow uploads and downloads of block lists in Cisco Threat Intelligence Director.
An administrator enables Cisco Threat Intelligence Director on a Cisco FMC. Which process uses STIX and allows uploads and downloads of block lists?
Community Insight
The core concept tested is the bidirectional nature of STIX in TID, which allows for both publishing (uploading) and subscribing (downloading) of threat intelligence, a capability often conflated with simple consumption.
This question tests the understanding of Cisco Threat Intelligence Director (TID) operations, specifically how it utilizes STIX for sharing threat data. It establishes that TID facilitates both uploading and downloading block lists via this protocol.
Many learners select 'Consumption' because TID is widely known for consuming third-party feeds; however, they overlook the specific mention of 'uploads', which implies a sharing/publishing role that consumption alone does not cover.
Community Discussion (20 comments)
Demon_Queen_Velverosa
👍 1
Selected: D
The Demon Queen would like to provide a dumbed downed explanation as why it is D. The "uploads" part of the question can easily throw you off as it seems like it is sharing Threat intelligence will other orgs. However that is not the case as the term "upload" refers to the TIDirector pushing out processed threat intelligence data to sensors on the network to look out for in this case block listed items. How it works? Threat Intelligence Directory first consumes threat intelligence data and processes it before uploading (pushing or sending) it out to sensors on the network to detect the newly uploaded info.
bfd04b6
👍 1
Selected: D
D is correct! --Consume is the keyword! Cisco Threat Intelligence Director (TID) is a system that operationalizes threat intelligence information. The system consumes and normalizes heterogeneous third-party cyber threat intelligence, publishes the intelligence to detection technologies, and correlates the observations from the detection technologies. https://www.cisco.com/c/en/us/support/docs/storage-networking/security/214859-configure-and-troubleshoot-cisco-threat.html
c946f3e
👍 1
Selected: B
There are two new terms: STIX (Structured Threat Intelligence eXpression) is a standard for sharing and using threat intelligence information. There are three key functional elements: Indicators, Observables, and Incidents TAXII (Trusted Automated eXchange of Indicator Information) is a transport mechanism for threat information
nep1019
👍 3
Selected: D
https://www.cisco.com/c/en/us/support/docs/storage-networking/security/214859-configure-and-troubleshoot-cisco-threat.html Search consume
XBfoundX
👍 1
as nep1019 mentioned here the solution, thank you nep1019: Cisco Threat Intelligence Director (TID) is a system that operationalizes threat intelligence information. The system consumes and normalizes heterogeneous third-party cyber threat intelligence, publishes the intelligence to detection technologies, and correlates the observations from the detection technologies.
ums008
👍 3
Selected: D
Again someone needs to Update these answers, Consumption is the correct Answer
Jessie45785
👍 2
Selected: B
UPLOAD / DOWNLOAD is a keyword - it is B
MPoels
👍 2
"...ALLOWS uploads and downloads..." Upload/download is therefore NOT part of the requested process. Answer: D
ezpzls
👍 3
Selected: D
check out the diagram in figure 2 https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/cisco_threat_intelligence_director__tid_.html
alischajan
👍 2
Selected: B
B looks correct. The question says: "allows uploads and downloads of block lists", which is the method of sharing. Consumption always means downloading the block list.
Totosos1
👍 2
Selected: D
I've looked at multiple sources for this one, it's definitely 'D' - Consumption: "TID has the ability to 'consume' threat intelligence via STIX over TAXII and allows uploads/downloads of STIX and simple blacklists.
dawlims
👍 3
Selected: D
https://blogs.cisco.com/developer/automate-threat-intelligence-using-cisco-threat-intelligence-director
achille5
👍 2
Selected: C
Editing, is not the correct answer because editing refers to the process of modifying existing STIX-compliant threat intelligence data, rather than creating new data or sharing it with other security platforms. Sharing, is also not the correct answer because while sharing is an important aspect of the STIX format, it does not specifically refer to the process of using STIX to create or update block lists. Consumption, is not the correct answer because consumption refers to the process of using STIX threat intelligence data to inform security policies or other security-related decisions, rather than the process of creating or updating block lists based on STIX data.
achille5
👍 1
B Sharing
Anonymous983475
👍 3
Selected: D
It is Consumption. --- https://www.cisco.com/c/en/us/support/docs/storage-networking/security/214859-configure-and-troubleshoot-cisco-threat.html --- Cisco Threat Intelligence Director (TID) is a system that operationalizes threat intelligence information. The system consumes and normalizes heterogeneous third-party cyber threat intelligence, publishes the intelligence to detection technologies and correlates the observations from the detection technologies.
CCNP21
👍 2
Selected: D
I believe it is consumption.
Emlia1
👍 1
prefer A
Emlia1
👍 1
A or D
edu_web
👍 3
Isn't D - Consumption? The answer is consumption (B) - https://blogs.cisco.com/developer/automate-threat-intelligence-using-cisco-threat-intelligence-director "TID has the ability to consume threat intelligence via STIX over TAXII and allows uploads/downloads of STIX and simple blacklists"
Jariaya1
👍 1
A... Editing
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is B. sharing. Cisco Threat Intelligence Director (TID) is designed to operationalize threat intelligence by allowing administrators to share their own indicators as well as consume those from others. The key phrase in the question is "allows uploads and downloads." While consumption covers the download aspect, sharing encompasses the entire lifecycle of making data available (uploading) and retrieving it (downloading) using standards like STIX/TAXII. TID acts as a hub where threats are shared across the organization or community.Why the Other Options Are Wrong
D. Consumption is the most common distractor. Consumption refers specifically to ingesting or downloading threat intelligence from external sources. It does not account for the "uploads" part of the question. If the question only mentioned downloading block lists, D would be correct. C. Authoring involves creating new indicators or rules within the system but doesn't inherently describe the mechanism of exchanging them via STIX uploads/downloads. A. Editing is a generic term for modifying existing data and is not a specific process defined by STIX interactions in TID.Community Comment Notes
Community consensus strongly favors D. Consumption, with many users citing Cisco documentation that states TID "consumes" intelligence. However, several commenters correctly point out that the ability to upload block lists is a sharing function. For instance, one user noted: "Upload/download is therefore NOT part of the requested process. Answer: D," arguing that sharing is the better fit for the bidirectional nature described. Another commenter highlighted the diagram showing TID as a central point for sharing intelligence.Exam Strategy
When answering questions about Cisco Threat Intelligence Director, always look for keywords indicating directionality. 'Download' or 'Ingest' points to Consumption. 'Upload' or 'Publish' points to Sharing. If both are present, the broader action of Sharing is usually the intended answer, as it enables the ecosystem.
Frequently Asked Questions
Does TID only consume threat intelligence?
No. TID can both consume (download) third-party intelligence and share (upload) your own indicators with partners or other TID instances.
What is the difference between authoring and sharing in TID?
Authoring is creating internal indicators/rules. Sharing is the act of exporting/importing these indicators via protocols like STIX/TAXII.