Playbook Development

Where do you go in the Cortex XSOAR UI to create and modify playbooks visually?

When building a custom playbook, you want to ensure that a specific task provides clear guidance to a human analyst who has to review phishing emails manually. Which task type should you add to the playbook canvas?

You are configuring a playbook task to execute an integration command, but the required argument value is not available until runtime from an external email message body. How should you pass this dynamic value into the task argument?

You are designing a playbook that needs to dynamically run different sub-playbooks based on the threat intelligence severity returned from an indicator enrichment task. Which playbook component should you use to implement this conditional routing?

When configuring a data collection task in a playbook, you need to assign the user's response to a specific incident field. Where do you map this response within the task configuration?

You are configuring a playbook task that calls a python-based custom automation. The automation requires a list of IP addresses. If the context path ${IP.Address} contains multiple items, how does XSOAR automatically pass this list to the script argument by default?

Which file format does Cortex XSOAR use when exporting a playbook for backup or migration to another server?

An engineer is troubleshooting a playbook where a task is skipped unexpectedly. Upon reviewing the task configuration, they notice a condition set in the 'Conditions' tab. What evaluates this condition to determine if the task runs or is skipped?

An XSOAR Engineer wants to extract specific artifacts from a sub-playbook and ensure they are promoted to the parent incident's main context. How is context scoping handled between parent and sub-playbooks by default?

You want to build a playbook that iterates through a list of alert IDs and runs an enrichment command for each ID. Which task type should you use to achieve this iteration?

An XSOAR Engineer needs to modify the behavior of a built-in playbook supplied by a content pack without losing updates when the content pack is upgraded. What is the best practice approach?

You are building a playbook and need to execute three different enrichment tasks (Active Directory query, Threat Intel lookup, and DNS resolution) simultaneously before proceeding to an analysis task. How should you connect these tasks on the canvas?

What is the purpose of the 'Playbook Description' field when creating a new custom playbook?

When configuring a playbook task to send an email notification, you want to attach a file that was generated during a previous task and stored in the Incident Context under ${File}. How do you reference this file in the task's file attachment argument?

An engineer is designing a playbook that processes incoming phishing alerts. If an analyst clicks 'False Positive' on a manual task, the playbook should jump backward to a previous cleanup task. Does Cortex XSOAR support backward transitions in playbooks?

You need to ensure that a specific playbook task only executes if the incident severity is 'High' or 'Critical'. Where do you apply this filtering logic?

When viewing a running playbook in an active incident, what do the different task border colors (such as green, red, or blue) typically indicate?

An engineer is configuring a playbook task to extract indicators using a built-in parsing script. The script outputs indicators to the incident context, but the engineer wants to ensure these indicators are automatically added to the Threat Intelligence module as indicators. How is this achieved?

Which TWO of the following are valid task types available when building a playbook in the Cortex XSOAR visual designer? (Choose two)

You are configuring a sub-playbook call in a parent playbook. You want the parent playbook to pause and wait for the sub-playbook to fully complete before executing the next task. Is this synchronous execution the default behavior for sub-playbooks?

An engineer needs to document a complex conditional branch inside a playbook so that other team members understand the business logic. Where can notes or documentation be added directly within the playbook design interface?

When configuring task inputs in a playbook, which TWO methods can be used to provide values to a command argument? (Choose two)

Which TWO tabs are typically found in the task properties drawer when configuring an Automation task in a playbook? (Choose two)

When managing playbook versions and content packs in Cortex XSOAR, which THREE best practices apply to playbook development? (Choose three)

Which TWO methods can an engineer use to view the execution history or audit trail of a completed playbook task in an incident? (Choose two)

Which THREE features are supported when designing sub-playbooks in Cortex XSOAR? (Choose three)

Which THREE settings can be configured within a Conditional Task in a playbook? (Choose three)

An XSOAR Engineer is troubleshooting a playbook where a custom automation script fails to receive expected arguments. Which THREE diagnostic steps should the engineer perform? (Choose three)

Which TWO options are primary benefits of utilizing Cortex XSOAR playbooks in security operations? (Choose two)

When configuring advanced playbook data transformations, which THREE built-in transformers or methods can be used to manipulate strings or lists in Cortex XSOAR context expressions? (Choose three)

Which THREE items are typically required or recommended when publishing a custom playbook for organization-wide use? (Choose three)

An XSOAR Engineer is designing a playbook and needs to execute an integration command that is not associated with an existing out-of-the-box task. Which task type should the engineer add to the playbook to run a direct python script or specific command?

An engineer needs to ensure that a specific playbook task only executes if the previous task returned a verdict of 'Malicious'. Where should the engineer configure this filtering logic?

An engineer is configuring a playbook task that calls a sub-playbook. The parent playbook needs to pass a dynamic list of IP addresses stored in an incident field to the sub-playbook as an input argument. How should this be configured in the sub-playbook task mapping?

While building a playbook, an engineer needs to prompt an analyst to review a list of indicators and make a decision to block or ignore them before the playbook continues. Which task type should be used?

An engineer has configured a playbook task that outputs a list of user objects into the context key 'Account'. The next task needs to iterate over each user object in this list to perform an Active Directory lookup. Which playbook feature should the engineer use?

An engineer is mapping outputs from an integration command to the XSOAR context. The integration returns a key named 'IPAddress', but standard XSOAR naming conventions and downstream playbook tasks expect 'IP'. How can the engineer transform this output during the mapping phase without modifying the integration code?

When designing a custom playbook in XSOAR, which TWO types of tasks are available for controlling the flow and execution path of the playbook? (Choose two)

An XSOAR engineer wants to create a playbook that can be triggered manually by an analyst from the Incident War Room or Summary page, but should never be triggered automatically by incoming email fetches. How should the engineer configure the playbook settings?

When exporting a playbook as part of a Content Pack in XSOAR, which THREE elements should an engineer verify are correctly included or referenced to ensure the pack installs and runs successfully in a target production environment? (Choose three)

An engineer is building a playbook that must run a set of enrichment tasks only when the incident severity is at least 'High'. The severity field is already populated in the incident context. The engineer wants to avoid duplicating tasks for each possible severity value. Which approach is most appropriate?

You are building a playbook that must run a series of tasks in parallel to save time. After all parallel branches complete, you need to consolidate their outputs and continue with a single task. Which task type should you use to wait for all parallel branches to finish before proceeding?

An engineer wants a playbook to dynamically decide the next task based on a severity value that is computed at runtime by a script. The playbook must branch to different tasks depending on whether the computed severity is 'High', 'Medium', or 'Low'. Which task type should be used to achieve this dynamic branching?

You are creating a playbook that includes a task to query a threat intelligence integration. The integration command returns a list of indicators, but you only want to proceed if the list is not empty. Which playbook task configuration should you use to evaluate the result and branch accordingly?

An engineer is designing a playbook that must iterate over a list of IP addresses stored in the incident context under the key 'IPs'. For each IP, the playbook should run a reputation check and then add a note to the incident. Which playbook task type should be used to loop over the list and execute the sub-tasks for each item?

An engineer is creating a playbook that needs to send an email notification to the security team when a high-severity incident is detected. The engineer wants to include the incident ID and severity in the email body. Which task type should be used to compose and send the email?

A playbook task is configured to run a command that returns a large JSON object. The engineer wants to store only a specific nested field from the command result into the incident context for later use. Which task configuration should be used?

An engineer is designing a playbook that includes a sub-playbook to perform IP enrichment. The sub-playbook returns a list of enriched IPs in its context under the key 'EnrichedIPs'. The engineer wants to access this list in the parent playbook to use in a subsequent task. Which syntax should be used to reference the list in the parent playbook task?

An engineer is building a playbook and wants to add a task that will pause the playbook and wait for an analyst to manually approve a remediation action. The task should present the analyst with a form to approve or reject. Which task type should the engineer use?

An engineer wants to reuse a set of tasks across multiple playbooks without duplicating them. The tasks include several integration commands and a condition. What is the most efficient way to achieve this in Cortex XSOAR?

An XSOAR Engineer is designing a playbook that must handle multiple branches based on indicator reputation. The engineer wants to ensure that certain tasks only execute when the indicator's reputation is 'Bad' or 'Suspicious'. Which TWO methods can be used to implement this conditional logic in the playbook? (Choose two.)

An engineer wants to test a playbook that is still in development. The playbook should only be triggered for incidents with the type 'Phishing' and severity 'High'. Which configuration ensures the playbook runs only under these conditions?

An engineer is debugging a playbook that occasionally fails when a task calls an automation script. The script expects a JSON string as input, but the engineer is passing a context object directly. The playbook sometimes works and sometimes fails, depending on the data. Which action should the engineer take to ensure the automation receives the correct input type?

An engineer is building a playbook that must route incidents to different analysts based on severity. The severity is stored in the incident field 'severity' and can be 'Low', 'Medium', 'High', or 'Critical'. The engineer wants to assign the incident to the 'Tier1' team for Low and Medium, and to the 'Tier2' team for High and Critical. What is the most efficient way to implement this routing in the playbook?

An engineer is developing a playbook that includes a task to run an integration command. The command returns a JSON object with a field 'result' that contains a list of indicators. The engineer wants to iterate over each indicator in the list and perform a sub-playbook for each one. Which playbook feature should the engineer use to accomplish this?

An engineer is building a playbook that calls a sub-playbook to enrich indicators. The sub-playbook returns a list of enriched indicators in the context key 'EnrichedIndicators'. The engineer needs to pass this list to a subsequent task that expects a comma-separated string of indicator values. Which transformer should be used to convert the list to a comma-separated string?