While configuring a Cortex XSOAR integration instance in XSIAM for automated enrichment, the test fails with a certificate validation error when communicating with an on-premises internal API. Where should the custom CA certificate be uploaded within XSIAM to resolve this?
An administrator needs to monitor the health and status of active data collection integrations in XSIAM. Which dashboard or menu provides visibility into data ingestion rates and agent/collector statuses?
When setting up a new Broker VM to collect logs, what is the initial deployment step required in the XSIAM console before downloading the virtual machine image?
An automation engineer needs to ensure that a specific integration command runs with restricted permissions. Where are integration command execution permissions or role-based access controls managed in XSIAM?
An XSIAM administrator wants to test connectivity to an external REST API integration without running a full playbook. Which feature in XSIAM allows direct testing of integration commands?
An organization requires that all log data ingested from a specific cloud service provider be enriched with asset metadata before being evaluated by XSIAM correlation rules. Which XSIAM feature should be configured to accomplish this data enrichment during the ingestion pipeline?
You are configuring a new ingestion integration for a cloud provider via API. You notice that data is not arriving in Cortex XSIAM despite the integration being marked as 'Active'. Where should you first verify the ingestion status and potential API credential errors?
A security engineer is building a custom integration in XSIAM that requires a secret API key. The engineer wants the key to be securely stored and not visible in playbook logs or the integration code. Which XSIAM feature should be used to store the API key?
A Cortex XSIAM engineer is building a playbook that must call a custom integration command only if a previous command's output contains the key 'severity' with value 'high'. The playbook currently runs all tasks sequentially and ignores conditions. Which mechanism should the engineer use to conditionally execute the custom command?
An XSIAM engineer is building a playbook that must call a custom Python integration to enrich an alert. The integration requires an API token stored in the Cortex XSIAM credential store. The playbook needs to reference this token securely without exposing it in logs or task inputs. Which configuration should the engineer use to pass the credential to the integration command?
A security team wants to automate the response to a specific type of alert. They need to ensure that the playbook runs automatically when an alert with a certain name is created, and that it only runs once per alert to avoid duplicate actions. Which TWO configurations are required to achieve this? (Choose two.)
An XSIAM engineer is building a playbook that must execute a custom Python script to enrich indicators of compromise. The script requires access to an API key stored in Cortex XSIAM. Where should the engineer store this API key so that it can be securely referenced by the automation?
An XSIAM automation engineer needs to ensure that a custom playbook can be invoked directly from the CLI for troubleshooting without publishing it. Which Cortex XSIAM feature allows this?
An automation engineer is building a playbook in Cortex XSIAM that must pause for up to 30 minutes while a malware sandbox analysis completes, then resume and branch on the verdict. The engineer needs the task to wait without consuming a playbook worker thread that would otherwise be idle. Which task type should be configured for the wait step?
An engineer needs to ensure that a Cortex XSIAM automation script can access an API key stored in the tenant's secrets store without exposing it in the script code or playbook. The script runs as part of a playbook and must retrieve the key at runtime. Which method should the engineer use?
A security team wants to automatically create a Jira ticket for every new high-severity alert in Cortex XSIAM. The Jira integration is already configured and working. The team wants to minimize manual effort and ensure that the ticket includes the alert's description and severity. Which XSIAM feature should be used to achieve this?
An XSIAM engineer is designing a new automation that must conditionally branch based on the severity of an alert and then send a notification to a Slack channel only for high-severity alerts. Which two components are required to implement this logic in a playbook? (Choose two.)
A Cortex XSIAM engineer is troubleshooting a custom automation script that runs inside a playbook and intermittently fails with timeout errors when calling an external enrichment API. The script also needs to read a value returned by an earlier playbook task. Which two approaches correctly address these needs? (Choose two.)
A security engineer is designing a playbook in Cortex XSIAM that must execute a series of automated remediation actions on endpoints. The engineer wants to ensure that if any action fails, the playbook stops immediately and does not proceed to subsequent actions. Which playbook task configuration should be used to achieve this behavior?
An XSIAM engineer is troubleshooting a playbook that intermittently fails when calling an external REST API integration. The integration instance test succeeds, but during playbook execution, some tasks receive HTTP 429 responses. The engineer wants to make the playbook more resilient without modifying the integration code. Which approach should the engineer take?
An engineer is creating a new custom integration in Cortex XSIAM to interact with a proprietary REST API. The integration will include several commands that require authentication. The engineer wants to ensure that the integration can be configured with multiple instances, each with different credentials and server URLs. Which TWO parameters must be defined in the integration's YAML configuration to support this requirement? (Choose two.)
A security analyst is troubleshooting a Cortex XSIAM playbook that is not triggering as expected when a new high-severity incident is created. The playbook is configured with a trigger that uses a query to filter incidents. The analyst checks the playbook's trigger configuration and sees that the query is 'severity = high'. However, the playbook is not executing for any incidents. What is the most likely cause?
An engineer is designing a custom integration for Cortex XSIAM that will fetch indicators from an external threat intelligence platform. The integration must support incremental fetching to avoid re-processing old indicators. Which TWO configuration elements are required to implement incremental fetching correctly? (Choose two.)
An XSIAM engineer is configuring a new integration that will be used by multiple playbooks. The integration requires several configuration parameters, including an API key and a base URL. The engineer wants to ensure that the API key is stored securely and is not visible in plain text to other users who can view the integration configuration. What should the engineer do?
An XSIAM engineer is creating a new playbook that will automate the response to phishing incidents. The playbook must extract indicators of compromise (IOCs) from the incident's email attachments and then check their reputation using an external threat intelligence service. The engineer wants to ensure that the playbook can handle multiple attachments and IOCs efficiently. Which two actions should the engineer take to achieve this? (Choose two.)
An XSIAM engineer is creating a new automation script that will be used in a playbook. The script needs to access the incident's custom fields to make decisions. Which method should the engineer use to retrieve the value of a custom field named 'business_unit' from the incident?
An XSIAM engineer is building a playbook that includes a task to run a custom Python script. The script needs to make an HTTP request to an external API that requires authentication using a token. The engineer wants to store the token securely and ensure it is not exposed in the playbook's task inputs or outputs. What is the best practice to achieve this?
An automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be used to execute commands against the Cortex XSOAR/XSIAM engine?
An engineer needs to ingest custom JSON-formatted logs from an internal application using an HTTP API. Which XSIAM feature should be configured to receive these incoming webhook payloads?
An administrator is configuring a new syslog data source in XSIAM to ingest logs from a third-party firewall. Which component must be deployed on-premises to securely receive and forward these logs to the XSIAM tenant?
An XSIAM engineer is troubleshooting a newly configured AWS CloudTrail integration. Log data is not appearing in the XSIAM query builder. Which log collection method is natively utilized by XSIAM to pull AWS CloudTrail logs?
An administrator wants to install a new integration pack to automate ticket creation in ServiceNow. Where in the XSIAM interface should the administrator navigate to find and install this pack?
An engineer is configuring a webhook integration to forward XSIAM alerts to an external ticketing platform. The external system requires custom HTTP headers for authentication. Where can these custom headers be configured within the integration instance?
An enterprise environment requires all outbound API traffic from XSIAM integrations to pass through an explicit corporate proxy server. Where is the global proxy configuration specified for integration instances?
An engineer is mapping a non-standard third-party security log source into the XSIAM Common Data Model (XDM). Which tool within XSIAM should be used to define custom parsing rules and field mappings?
An XSIAM administrator is configuring automated log ingestion filtering to drop high-volume, low-value informational events before they consume license quota. Which feature enables this capability?
An administrator configured a Microsoft Graph API integration to pull security alerts into XSIAM. The connection status shows 'Active', but no alerts are being pulled. Reviewing the integration instance configuration, which common misconfiguration typically causes this behavior while keeping the authentication valid?
An enterprise security team wants to ensure that all data ingested from a specific untrusted data source is automatically tagged with a specific tag for downstream analytics. Where can this automatic tagging rule be applied during integration setup?
An XSIAM administrator is configuring a new syslog data source to ingest security logs from an on-premises Linux firewall. Which Collector component must be deployed within the network perimeter to securely forward these logs to the XSIAM tenant?
An XSIAM administrator has created a custom parsing rule using Logstash-like syntax within XSIAM to normalize a non-standard application log format. After saving and enabling the parsing rule, incoming logs still appear unparsed under the 'Default' vendor product type. What is the most likely reason for this behavior?
An administrator is setting up an integration with a third-party threat intelligence platform using Cortex XSOAR capabilities embedded within XSIAM. The integration instance requires periodic polling to fetch newly published Indicators of Compromise (IoCs). Where should the administrator configure the fetch interval?
An XSIAM administrator is configuring a new API-based integration to ingest threat intelligence feeds. During configuration, what credential type is most commonly required by modern token-based REST API integrations?
An analyst wants to trigger an automated playbook in XSIAM immediately whenever a specific high-severity alert is generated by the Analytics engine. Where should the analyst configure this automated linkage?
An XSIAM administrator is troubleshooting an integration instance that is failing to connect to an external ticketing system. The administrator needs to verify whether the underlying API calls are failing due to invalid credentials or network timeouts. Where should the administrator review detailed debug logs for this specific integration instance?
An administrator is planning the deployment of Broker VMs to support data ingestion across multiple isolated network segments. Which TWO considerations are critical for proper Broker VM architecture and sizing? (Choose two)
An XSIAM engineer is configuring automated incident response playbooks that interact with third-party tools via Cortex XSOAR integration commands. Which THREE best practices should be followed when designing robust automation playbooks? (Choose three)
An administrator is configuring data ingestion in XSIAM and needs to ensure that logs from a custom internal application are correctly normalized. Which THREE components are essential parts of the XSIAM log ingestion and normalization pipeline? (Choose three)
A security analyst needs to automate a recurring task that involves enriching alerts with data from a third-party threat intelligence platform. Which component of XSIAM is specifically designed for this cross-platform workflow?
When setting up a new Data Collector, you need to ensure high availability for log collection from a remote site. What is the best practice for deploying the collectors?
You are troubleshooting a parsing error where logs from a custom application are not being mapped correctly to the XDM schema. What is the recommended approach to debug the transformation process?
You are configuring a custom integration that requires sending an HTTP POST request to a legacy internal system. Which feature allows you to securely manage the connection credentials?
An automation playbook fails because the JSON response from an API call contains nested objects that are not being parsed correctly. What is the best way to handle this in a playbook?
You are writing a custom XQL query to filter logs, but you find that the field names are inconsistent across your data sources. How can you standardize these fields for your automation?
An engineer is building a Cortex XSIAM automation that must call an external REST API. The API requires a static API key that must never appear in playbook exports, task inputs, or the war room. The key must also be usable by multiple playbooks and be rotatable without editing any playbook. Which mechanism should the engineer use to store and reference the API key?
An engineer has a Cortex XSIAM playbook that enriches alerts by querying an internal CMDB through a REST API integration. The integration instance is configured and passes connectivity tests, but during playbook execution the enrichment task returns an authentication error only when the playbook is triggered by an alert from a specific data source. The same task succeeds on every other trigger. What is the most likely cause?
An automation engineer wants a playbook to send a notification to a Slack channel only when a critical incident is created. The playbook is triggered by an incident creation event. Which XSIAM playbook task type should be used to conditionally execute the Slack notification task?
An XSIAM engineer needs to create a playbook that automatically enriches IP addresses from an incident by querying a threat intelligence integration. The enrichment should only occur if the incident contains at least one IP address. Which playbook task should be used to extract the IP addresses from the incident for further processing?
A Cortex XSIAM engineer is building a playbook that must wait for an external SOC analyst to approve a high-risk containment action before proceeding. The playbook should pause execution and resume only after the analyst submits a response through a form link. Which task type should the engineer add to the playbook to accomplish this?
A Cortex XSIAM engineer is designing a playbook that must handle a high volume of alerts. The playbook includes a task that calls an external enrichment integration which can be slow or unresponsive. The engineer wants to ensure that a failure in this enrichment task does not halt the entire playbook and that the playbook continues to the next task. Which task configuration should the engineer apply?
An engineer is writing a custom Python integration for XSIAM that enriches indicators by querying an internal threat-intelligence API. The API returns a JSON body with a nested 'data.attributes' object, and the engineer wants each nested field exposed as a separate command output that analysts can reference in playbook context paths. Which approach should the engineer take in the integration code?
An automation engineer is building a custom Python integration in Cortex XSIAM that must retrieve a list of indicators from an external threat intelligence platform. The platform's API returns a JSON object with a nested array under the key 'data'. The engineer wants the integration command to output a clean list of indicators that can be used in subsequent playbook tasks. Which approach should the engineer take to parse the API response and return the indicators?
A Cortex XSIAM engineer is troubleshooting a custom automation script that runs as part of an incident response playbook. The script intermittently fails with timeout errors when it calls an external enrichment API, and the engineer wants to make the playbook more resilient without changing the external service. Which TWO changes should the engineer make? (Choose two.)
A security engineer needs to create a custom automation script in Cortex XSIAM that will be used across multiple playbooks. The script must be able to call other integrations and process results. Which type of automation should the engineer create?
An XSIAM engineer is configuring an integration instance for a third-party threat intelligence platform. The integration requires authentication and the engineer wants to ensure that the credentials are handled securely and that the instance can be used by playbooks. Which two actions should the engineer take? (Choose two.)
A security team wants a Cortex XSIAM playbook to automatically assign every newly created high-severity incident to the on-call analyst based on the current shift schedule maintained in an external system. Which capability should the engineer use to fetch the on-call user at runtime?
An XSIAM administrator needs to ensure that a newly created automation script can be executed by playbooks. The script is written in Python and uses the XSIAM automation libraries. What must be done to make the script available for use in playbooks?
An XSIAM engineer needs to store a sensitive API key that will be used by multiple playbooks. The key must be encrypted and accessible only to specific playbooks. Which XSIAM feature should be used?
A Cortex XSIAM engineer needs an automation to run every time a new alert is created, before any analyst reviews it, so that enrichment and severity scoring happen automatically. The engineer wants the automation to execute based on the alert's attributes without a human starting it. Which trigger mechanism should be used?
An engineer is designing an XSIAM playbook that must delete a malicious file from an endpoint and then verify the deletion succeeded before closing the incident. The vendor's endpoint integration exposes separate 'isolate', 'delete file', and 'list files' commands. Which design approach best ensures the verification step reflects the true post-deletion state?
An XSIAM engineer wants to test a new automation script that parses indicators from an external threat feed. The script should run automatically every hour. Which XSIAM feature should be used to schedule this script?
A Cortex XSIAM engineer writes a custom Python automation that must return a structured result to the playbook so a later conditional task can branch on a specific field. The engineer wants the returned data to be accessible as a named output rather than only as raw command output. Which action should the script take to expose the value?
A Cortex XSIAM engineer deploys a new custom integration that calls an internal ticketing API. The integration works when tested from the engineer's workstation but fails inside XSIAM with connection errors, and the API requires a client certificate that the engineer generated locally. What should the engineer configure to let the integration present that certificate?
A Cortex XSIAM engineer needs to create a new automation script that will be used across multiple playbooks. The script must accept an input argument called 'incident_id' and return the incident's severity as a string. Which step is required to make the script available for use in playbooks?
A security analyst wants to manually run a specific automation script from the Cortex XSIAM incident War Room to enrich an indicator. The script is already uploaded and available in the tenant. Which action should the analyst take to execute the script directly from the War Room command line?
An engineer is troubleshooting a Cortex XSIAM playbook that fails at a task calling a custom integration command. The command works when run manually from the War Room but fails within the playbook. The playbook task is configured to use the integration instance 'TI-Platform'. Which is the most likely cause of the failure?
An XSIAM engineer is developing a custom integration that must process a large volume of events. The integration uses a Python script that makes an API call to an external service for each event. The engineer notices that the integration is slow and sometimes times out. The external API supports batch requests, allowing up to 100 events per request. What should the engineer do to improve performance?