Integration And Automation

An automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be used to execute commands against the Cortex XSOAR/XSIAM engine?

An engineer needs to ingest custom JSON-formatted logs from an internal application using an HTTP API. Which XSIAM feature should be configured to receive these incoming webhook payloads?

An administrator is configuring a new syslog data source in XSIAM to ingest logs from a third-party firewall. Which component must be deployed on-premises to securely receive and forward these logs to the XSIAM tenant?

An XSIAM engineer is troubleshooting a newly configured AWS CloudTrail integration. Log data is not appearing in the XSIAM query builder. Which log collection method is natively utilized by XSIAM to pull AWS CloudTrail logs?

An administrator wants to install a new integration pack to automate ticket creation in ServiceNow. Where in the XSIAM interface should the administrator navigate to find and install this pack?

An engineer is configuring a webhook integration to forward XSIAM alerts to an external ticketing platform. The external system requires custom HTTP headers for authentication. Where can these custom headers be configured within the integration instance?

An enterprise environment requires all outbound API traffic from XSIAM integrations to pass through an explicit corporate proxy server. Where is the global proxy configuration specified for integration instances?

An engineer is mapping a non-standard third-party security log source into the XSIAM Common Data Model (XDM). Which tool within XSIAM should be used to define custom parsing rules and field mappings?

Which protocol is natively supported by the Broker VM Syslog collector for receiving log streams from network devices?

An XSIAM administrator is configuring automated log ingestion filtering to drop high-volume, low-value informational events before they consume license quota. Which feature enables this capability?

An administrator configured a Microsoft Graph API integration to pull security alerts into XSIAM. The connection status shows 'Active', but no alerts are being pulled. Reviewing the integration instance configuration, which common misconfiguration typically causes this behavior while keeping the authentication valid?

An enterprise security team wants to ensure that all data ingested from a specific untrusted data source is automatically tagged with a specific tag for downstream analytics. Where can this automatic tagging rule be applied during integration setup?

Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)

Which TWO actions can an administrator perform when managing integration instances within XSIAM? (Choose two)

Which THREE configuration steps are typically required when setting up a new Broker VM instance in XSIAM? (Choose three)

Which THREE parameters can be configured when setting up a log ingestion parsing rule in XSIAM? (Choose three)

When troubleshooting a failing integration instance in XSIAM, which THREE tools or logs are most useful for diagnosing the root cause? (Choose three)

Which THREE best practices should be followed when designing custom automation integrations and playbooks in XSIAM? (Choose three)

Which TWO methods are supported in XSIAM for forwarding alerts or incident details to external SIEM or ticketing systems? (Choose two)

Which THREE security considerations are critical when configuring third-party integrations and API keys in XSIAM? (Choose three)

An XSIAM administrator is configuring a new syslog data source to ingest security logs from an on-premises Linux firewall. Which Collector component must be deployed within the network perimeter to securely forward these logs to the XSIAM tenant?

An XSIAM administrator has created a custom parsing rule using Logstash-like syntax within XSIAM to normalize a non-standard application log format. After saving and enabling the parsing rule, incoming logs still appear unparsed under the 'Default' vendor product type. What is the most likely reason for this behavior?

An administrator is setting up an integration with a third-party threat intelligence platform using Cortex XSOAR capabilities embedded within XSIAM. The integration instance requires periodic polling to fetch newly published Indicators of Compromise (IoCs). Where should the administrator configure the fetch interval?

An XSIAM administrator is configuring a new API-based integration to ingest threat intelligence feeds. During configuration, what credential type is most commonly required by modern token-based REST API integrations?

An analyst wants to trigger an automated playbook in XSIAM immediately whenever a specific high-severity alert is generated by the Analytics engine. Where should the analyst configure this automated linkage?

An XSIAM administrator is troubleshooting an integration instance that is failing to connect to an external ticketing system. The administrator needs to verify whether the underlying API calls are failing due to invalid credentials or network timeouts. Where should the administrator review detailed debug logs for this specific integration instance?

An administrator is planning the deployment of Broker VMs to support data ingestion across multiple isolated network segments. Which TWO considerations are critical for proper Broker VM architecture and sizing? (Choose two)

An XSIAM engineer is configuring automated incident response playbooks that interact with third-party tools via Cortex XSOAR integration commands. Which THREE best practices should be followed when designing robust automation playbooks? (Choose three)

An administrator is configuring data ingestion in XSIAM and needs to ensure that logs from a custom internal application are correctly normalized. Which THREE components are essential parts of the XSIAM log ingestion and normalization pipeline? (Choose three)

A security analyst needs to automate a recurring task that involves enriching alerts with data from a third-party threat intelligence platform. Which component of XSIAM is specifically designed for this cross-platform workflow?

When setting up a new Data Collector, you need to ensure high availability for log collection from a remote site. What is the best practice for deploying the collectors?

You are troubleshooting a parsing error where logs from a custom application are not being mapped correctly to the XDM schema. What is the recommended approach to debug the transformation process?

You are configuring a custom integration that requires sending an HTTP POST request to a legacy internal system. Which feature allows you to securely manage the connection credentials?

You need to ensure that a specific integration uses a dedicated proxy server to communicate with the cloud. Where is this proxy configuration defined?

When managing integrations in XSIAM, what is the purpose of the 'Test' button found in the integration instance configuration?

An automation playbook fails because the JSON response from an API call contains nested objects that are not being parsed correctly. What is the best way to handle this in a playbook?

You are writing a custom XQL query to filter logs, but you find that the field names are inconsistent across your data sources. How can you standardize these fields for your automation?

Which THREE of the following are critical components required for a successful data ingestion integration in XSIAM?

Which TWO of the following features help maintain data security during the integration process?

Which TWO of the following actions can be performed within the Cortex XSIAM Marketplace?

Which THREE of the following are benefits of using the XDM (eXtendable Data Model) in Cortex XSIAM?

An engineer is building a Cortex XSIAM automation that must call an external REST API. The API requires a static API key that must never appear in playbook exports, task inputs, or the war room. The key must also be usable by multiple playbooks and be rotatable without editing any playbook. Which mechanism should the engineer use to store and reference the API key?

An engineer has a Cortex XSIAM playbook that enriches alerts by querying an internal CMDB through a REST API integration. The integration instance is configured and passes connectivity tests, but during playbook execution the enrichment task returns an authentication error only when the playbook is triggered by an alert from a specific data source. The same task succeeds on every other trigger. What is the most likely cause?

An automation engineer wants a playbook to send a notification to a Slack channel only when a critical incident is created. The playbook is triggered by an incident creation event. Which XSIAM playbook task type should be used to conditionally execute the Slack notification task?

An XSIAM engineer needs to create a playbook that automatically enriches IP addresses from an incident by querying a threat intelligence integration. The enrichment should only occur if the incident contains at least one IP address. Which playbook task should be used to extract the IP addresses from the incident for further processing?

A Cortex XSIAM engineer is building a playbook that must wait for an external SOC analyst to approve a high-risk containment action before proceeding. The playbook should pause execution and resume only after the analyst submits a response through a form link. Which task type should the engineer add to the playbook to accomplish this?

A Cortex XSIAM engineer is designing a playbook that must handle a high volume of alerts. The playbook includes a task that calls an external enrichment integration which can be slow or unresponsive. The engineer wants to ensure that a failure in this enrichment task does not halt the entire playbook and that the playbook continues to the next task. Which task configuration should the engineer apply?

An engineer is writing a custom Python integration for XSIAM that enriches indicators by querying an internal threat-intelligence API. The API returns a JSON body with a nested 'data.attributes' object, and the engineer wants each nested field exposed as a separate command output that analysts can reference in playbook context paths. Which approach should the engineer take in the integration code?

An automation engineer is building a custom Python integration in Cortex XSIAM that must retrieve a list of indicators from an external threat intelligence platform. The platform's API returns a JSON object with a nested array under the key 'data'. The engineer wants the integration command to output a clean list of indicators that can be used in subsequent playbook tasks. Which approach should the engineer take to parse the API response and return the indicators?

A Cortex XSIAM engineer is troubleshooting a custom automation script that runs as part of an incident response playbook. The script intermittently fails with timeout errors when it calls an external enrichment API, and the engineer wants to make the playbook more resilient without changing the external service. Which TWO changes should the engineer make? (Choose two.)

A security engineer needs to create a custom automation script in Cortex XSIAM that will be used across multiple playbooks. The script must be able to call other integrations and process results. Which type of automation should the engineer create?

An XSIAM engineer is configuring an integration instance for a third-party threat intelligence platform. The integration requires authentication and the engineer wants to ensure that the credentials are handled securely and that the instance can be used by playbooks. Which two actions should the engineer take? (Choose two.)

A security team wants a Cortex XSIAM playbook to automatically assign every newly created high-severity incident to the on-call analyst based on the current shift schedule maintained in an external system. Which capability should the engineer use to fetch the on-call user at runtime?

An XSIAM administrator needs to ensure that a newly created automation script can be executed by playbooks. The script is written in Python and uses the XSIAM automation libraries. What must be done to make the script available for use in playbooks?

An XSIAM engineer needs to store a sensitive API key that will be used by multiple playbooks. The key must be encrypted and accessible only to specific playbooks. Which XSIAM feature should be used?

A Cortex XSIAM engineer needs an automation to run every time a new alert is created, before any analyst reviews it, so that enrichment and severity scoring happen automatically. The engineer wants the automation to execute based on the alert's attributes without a human starting it. Which trigger mechanism should be used?

An engineer is designing an XSIAM playbook that must delete a malicious file from an endpoint and then verify the deletion succeeded before closing the incident. The vendor's endpoint integration exposes separate 'isolate', 'delete file', and 'list files' commands. Which design approach best ensures the verification step reflects the true post-deletion state?

An XSIAM engineer wants to test a new automation script that parses indicators from an external threat feed. The script should run automatically every hour. Which XSIAM feature should be used to schedule this script?

A Cortex XSIAM engineer writes a custom Python automation that must return a structured result to the playbook so a later conditional task can branch on a specific field. The engineer wants the returned data to be accessible as a named output rather than only as raw command output. Which action should the script take to expose the value?

A Cortex XSIAM engineer deploys a new custom integration that calls an internal ticketing API. The integration works when tested from the engineer's workstation but fails inside XSIAM with connection errors, and the API requires a client certificate that the engineer generated locally. What should the engineer configure to let the integration present that certificate?

A Cortex XSIAM engineer needs to create a new automation script that will be used across multiple playbooks. The script must accept an input argument called 'incident_id' and return the incident's severity as a string. Which step is required to make the script available for use in playbooks?

A security analyst wants to manually run a specific automation script from the Cortex XSIAM incident War Room to enrich an indicator. The script is already uploaded and available in the tenant. Which action should the analyst take to execute the script directly from the War Room command line?

An engineer is troubleshooting a Cortex XSIAM playbook that fails at a task calling a custom integration command. The command works when run manually from the War Room but fails within the playbook. The playbook task is configured to use the integration instance 'TI-Platform'. Which is the most likely cause of the failure?

An XSIAM engineer is developing a custom integration that must process a large volume of events. The integration uses a Python script that makes an API call to an external service for each event. The engineer notices that the integration is slow and sometimes times out. The external API supports batch requests, allowing up to 100 events per request. What should the engineer do to improve performance?