Create a YARA-L detection rule to identify when an internal host initiates a network connection to an external IP that the Applied Threat Intelligence Fusion Feed associates with APT41. You must flag IP if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure?

• A. Rule detects outbound connections and a SOAR playbook queries Fusion Feed for APT41 relationship.
• B. Rule joins live network event with Fusion Feed data by external IP and filters explicit associations with APT41.
• C. Rule checks whether the external IP has a high confidence score across any enabled threat feed.
• D. Rule triggers when external IP matches a manually curated reference list of APT41 IPs.

Answer: (B)

The key idea is to correlate a real network event with threat intelligence data in a single evaluation, so you only flag an external IP when there is an explicit, documented link to APT41 within the Fusion Feed. Configure the YARA-L rule to perform a live join between the internal host’s outbound connection to an external IP and the Fusion Feed’s APT41 indicators for that same IP, then filter to keep only those external IPs that have an explicit relationship to APT41 indicators. This ensures the alert fires because the external IP isn’t just high risk in general; it has a specific, documented connection to APT41 within the Fusion Feed.

Relying on a separate SOAR step to query the Fusion Feed after the event (instead of a direct join) can introduce latency and loose coupling, while using a broad high-confidence score across any feed doesn’t target the APT41 relationship. A static, manually curated IP list ignores the dynamic relationships and updates provided by the Fusion Feed.