A file hash is evaluated in Cortex XSOAR by using two unique threat feeds:VirusTotal feed...

Cortex XSOAR uses an internal scoring engine called DBot to determine the final verdict of an indicator (IP, URL, Hash, etc.). When multiple threat intelligence sources provide conflicting information, XSOAR follows a specific logic to calculate the DBot Score :

Reliability Rating: First, XSOAR looks at the "Source Reliability." In this scenario, both VirusTotal and AlienVault have the same reliability rating ( B - Usually Reliable ).

Tie-Breaking Logic: When the reliability of the sources is equal, Cortex XSOAR defaults to the most severe verdict provided.

The Verdict: Between "Malicious" (Score 3) and "Benign" (Score 1), the system will prioritize the Malicious verdict to ensure the security team does not overlook a potential threat. If one source had a higher reliability (e.g., "A - Completely Reliable"), its verdict would override the lower-rated source regardless of severity.