39 questions · Cortex XSOAR And Automation · All types, answers revealed
You are creating a custom integration. Which file is required to define the integration parameters, scripts, and commands?
The YAML file is the manifest for the integration.
Why this answer
The integration-NAME.yml file contains the metadata and configuration structure for an integration.
If an automation script is taking too long to run, how can you improve its performance?
Reducing API round-trips significantly improves performance.
Why this answer
Using asynchronous execution (if supported) or refining the script logic to use batch processing instead of loops is the standard optimization method.
Which TWO settings are configurable within an Integration Instance?
Timeouts are configurable per instance.
Why this answer
Integration instances require specific connection details and often allow for custom mapping or filtering logic.
You want to share a playbooks across multiple tenants in a multi-tenant environment. Where should you place the playbook?
The Main account acts as the repository for shared content in multi-tenant environments.
Why this answer
Playbooks defined in the 'Host' or 'Shared' content pack are accessible to child tenants.
Where can you view the 'Context Data' for a specific incident?
This tab shows all key-value pairs associated with the investigation context.
Why this answer
The context data is visible in the 'Context Data' tab within the Incident view.
You have a large number of incidents that need to be processed by a specific playbook. What is the most efficient way to assign them?
Classifiers can automatically assign playbooks to incidents upon ingestion.
Why this answer
The 'Incident Auto-Classifier' or 'Automated Assignment' rules based on incident type or severity are the most efficient methods.
You are configuring a new integration instance for a third-party threat intelligence feed. Where should you verify the connection status and logs for this instance?
This is the primary location for configuring and monitoring integration connectivity.
Why this answer
The Integration Instance settings page contains the Test button to verify connectivity and the Integration Logs view to troubleshoot communication errors.
When designing a layout, which widget is used to display the timeline of events that occurred within a case?
The Timeline widget tracks all actions performed on an incident.
Why this answer
The Timeline widget is specifically designed to show the chronological history of case events.
Which THREE of the following are valid components of a standard Content Pack?
Scripts are part of content packs.
Why this answer
Content Packs contain various XSOAR objects like integrations, playbooks, and dashboards.
Which tab in the Incident view provides a real-time, user-friendly summary of the investigation status?
The Summary tab is the standard view for incident health and status.
Why this answer
The 'Summary' tab is designed to provide a high-level view of the case status and key artifacts.
Which TWO actions are commonly performed during the 'Pre-processing' phase of incident ingestion?
Mapping logic during pre-processing decides the execution flow.
Why this answer
Pre-processing rules allow for deduplication and incident enrichment/filtering before the incident is created or assigned.
An organization requires that sensitive PII data in incident notes is redacted before being sent to an external ticketing system. What is the most efficient way to perform this transformation in XSOAR?
Transformation scripts allow programmatic modification of data payloads before they are passed.
Why this answer
Using a Transformation script on the output of the integration command ensures data is cleaned before it reaches the external system.
Which TWO of the following are true regarding the use of the 'Context' in Cortex XSOAR?
The common context object is the standard data bus for playbooks.
Why this answer
The context is incident-specific and persistent throughout the investigation, and it acts as the primary data exchange mechanism.
When designing a custom layout, how do you make a field read-only for specific roles?
Field permissions allow granular access control per role.
Why this answer
In the Layout editor, you can set permissions on individual fields to control which roles have read-only or read-write access.
A Python script is failing with an 'Integration not found' error during execution. You have confirmed the integration is enabled. What is the likely issue?
Automation scripts require specific command execution syntax.
Why this answer
The command name inside the script must match the command defined in the integration's YAML file; if the command is prefixed with an integration name that is not active, it fails.
Which TWO of these are valid methods to trigger an automated playbook?
Incident Types can be configured to auto-run a playbook.
Why this answer
Playbooks can be triggered by incident ingestion (via Classifier) or manually by an analyst.
You are designing a playbook and need to ensure that a task only executes if the previous task returned a specific status. Which feature allows you to define these branching conditions?
Conditional tasks provide the logic to branch based on previous output.
Why this answer
Conditional tasks in XSOAR use logic to evaluate outputs and determine the path based on results.
Which THREE factors influence the performance of playbook execution?
Inefficient scripts consume more CPU/RAM.
Why this answer
Execution performance is influenced by the number of concurrent tasks, the complexity of the scripts being run, and the available worker resources.
Which THREE of the following are valid methods for triggering a playbook in Cortex XSOAR?
Analysts can manually launch playbooks.
Why this answer
Playbooks can be triggered automatically via classification, manually by an analyst, or through API requests.
A playbook is failing because a task output field is empty. You need to ensure the task handles this null value gracefully. What is the best way to implement this?
Conditional tasks allow for branching logic based on the presence or absence of data.
Why this answer
Using the 'Continue on error' or 'On failure' path, or using a condition task with 'is empty' logic, allows for robust error handling.
When configuring a new integration, you need to restrict the integration's access to only a subset of incident types. Which feature should be used?
Restricting the integration instance to specific incident types limits the scope of its operation.
Why this answer
Role-based access control and specific integration scope settings allow restricting which incidents an integration can interact with.
You want to trigger a playbook automatically whenever a new indicator is created of a specific type. Where is this configuration set?
Each Indicator Type can be associated with an auto-triggered playbook.
Why this answer
The 'Indicator Auto-Extraction' or 'Indicator Triggered Playbook' settings allow you to map indicator types to specific playbooks.
Which THREE of the following represent core components of a Cortex XSOAR incident?
Indicators are entities extracted and managed within an incident.
Why this answer
Incidents in XSOAR are composed of a War Room, indicators, and various data fields.
You need to access an array of indicator values stored in a playbook variable called 'indicatorsList'. Which syntax is correct for extracting the first item in the list within a task input?
This is the standard index-based access for lists in XSOAR automation.
Why this answer
Cortex XSOAR uses the ${var[index]} notation for list access in task inputs.
Which tool in Cortex XSOAR helps you debug a playbook in real-time by stepping through tasks?
The debugger allows for step-by-step execution and inspection.
Why this answer
The Playbook Debugger allows you to run a playbook in a controlled environment, inspecting data at each step.
Which THREE types of tasks can be added to a playbook workflow?
Condition tasks control the branching logic.
Why this answer
Playbooks support various task types including manual, automated, and condition tasks.
Which feature allows you to bundle playbooks, scripts, and integrations together for easy deployment across environments?
Content Packs allow for versioning and deployment of all XSOAR objects.
Why this answer
Content Packs are the standard vehicle for packaging and deploying XSOAR content.
An analyst needs to provide a summary of incident trends over the last 30 days to management. Which feature should be used to create an automated, recurring report?
The Report Builder allows for the creation of customized, scheduled, and recurring reports.
Why this answer
Reporting and Dashboards are used to aggregate and present incident data in XSOAR.
Which mechanism in Cortex XSOAR ensures that concurrent tasks do not attempt to update the same incident field simultaneously, causing a race condition?
Task locking prevents multiple concurrent tasks from modifying the same incident data.
Why this answer
Locking mechanisms prevent parallel processes from overwriting each other's data during incident updates.
Which THREE actions are available when configuring a 'Condition' task?
This is the most common use case for conditions.
Why this answer
Condition tasks allow for testing context values, checking for existence, and branching based on comparison results.
A playbook task is configured to run on a 'Worker' group. If you see the task stuck in 'Pending' state, what is the most likely cause?
Tasks assigned to a non-existent or inactive worker group will not execute.
Why this answer
If no workers are available in the assigned group to pick up the task, it will remain in a Pending state.
A security analyst wants to ensure that specific indicators extracted from email alerts are automatically enriched upon ingestion. Which component should the analyst configure to achieve this?
Auto-extraction settings allow for automated parsing and enrichment upon ingestion.
Why this answer
Indicator Auto-Extraction and enrichment settings are configured within the integration settings for specific instances or via global Indicator settings.
A user reports that a playbook is stuck at a manual task that requires input. What is the most likely cause if the 'Owner' field is populated but the task is not appearing in the user's Inbox?
Tasks are filtered by user role membership.
Why this answer
If the task is assigned to a role that the user is not part of, or if the task is set to 'Wait for user' but the role filtering is misconfigured, it will not appear.
What is the function of a 'Transformer' in a mapper?
Transformers perform operations like regex, string manipulation, or math before the data is saved.
Why this answer
Transformers allow you to manipulate or format data during the mapping process from the source to the target incident field.
Which object type should you use to store configuration data that needs to be accessed globally across multiple playbooks?
Lists provide global access to reference data in playbooks.
Why this answer
Lists are the standard objects for storing static key-value pairs or reference data across the system.
Which TWO methods can be used to pass data from a parent playbook to a sub-playbook?
Sub-playbooks can read directly from the shared incident context.
Why this answer
Data is passed to sub-playbooks via defined input mappings or by reading directly from the incident context.
Which THREE actions can be performed from the Incident 'Work Plan' tab?
Users can manually skip tasks if necessary.
Why this answer
The Work Plan tab allows users to view progress, manually trigger tasks, and re-run failed tasks.
You are troubleshooting a playbook that is stuck in a pending state. Where is the best place to inspect the raw JSON output of a specific integration task to determine why the next step was not triggered?
The Work Plan provides detailed task execution history and JSON outputs.
Why this answer
The Work Plan tab within the incident view allows you to drill down into task results and inspect raw inputs/outputs.
What happens if a playbook task is configured to 'Continue on error' and the task fails?
Setting 'Continue on error' prevents the playbook from stopping on failure.
Why this answer
The playbook will continue to the next designated path instead of terminating the execution.
Ready to test yourself?
Try a timed practice session using only Cortex XSOAR And Automation questions.