Integration And Automation

An analyst wants to trigger an automated playbook in XSIAM immediately whenever a specific high-severity alert is generated by the Analytics engine. Where should the analyst configure this automated linkage?

An XSIAM engineer needs to store a sensitive API key that will be used by multiple playbooks. The key must be encrypted and accessible only to specific playbooks. Which XSIAM feature should be used?

An XSIAM engineer is configuring automated incident response playbooks that interact with third-party tools via Cortex XSOAR integration commands. Which THREE best practices should be followed when designing robust automation playbooks? (Choose three)

An administrator configured a Microsoft Graph API integration to pull security alerts into XSIAM. The connection status shows 'Active', but no alerts are being pulled. Reviewing the integration instance configuration, which common misconfiguration typically causes this behavior while keeping the authentication valid?

An engineer is writing a custom Python integration for XSIAM that enriches indicators by querying an internal threat-intelligence API. The API returns a JSON body with a nested 'data.attributes' object, and the engineer wants each nested field exposed as a separate command output that analysts can reference in playbook context paths. Which approach should the engineer take in the integration code?

A Cortex XSIAM engineer needs to create a new automation script that will be used across multiple playbooks. The script must accept an input argument called 'incident_id' and return the incident's severity as a string. Which step is required to make the script available for use in playbooks?

An XSIAM administrator has created a custom parsing rule using Logstash-like syntax within XSIAM to normalize a non-standard application log format. After saving and enabling the parsing rule, incoming logs still appear unparsed under the 'Default' vendor product type. What is the most likely reason for this behavior?

An administrator is configuring data ingestion in XSIAM and needs to ensure that logs from a custom internal application are correctly normalized. Which THREE components are essential parts of the XSIAM log ingestion and normalization pipeline? (Choose three)

An XSIAM administrator is configuring automated log ingestion filtering to drop high-volume, low-value informational events before they consume license quota. Which feature enables this capability?

A security team wants a Cortex XSIAM playbook to automatically assign every newly created high-severity incident to the on-call analyst based on the current shift schedule maintained in an external system. Which capability should the engineer use to fetch the on-call user at runtime?

An XSIAM administrator needs to ensure that a newly created automation script can be executed by playbooks. The script is written in Python and uses the XSIAM automation libraries. What must be done to make the script available for use in playbooks?

You are configuring a custom integration that requires sending an HTTP POST request to a legacy internal system. Which feature allows you to securely manage the connection credentials?

An administrator is configuring a new syslog data source in XSIAM to ingest logs from a third-party firewall. Which component must be deployed on-premises to securely receive and forward these logs to the XSIAM tenant?

A security analyst wants to manually run a specific automation script from the Cortex XSIAM incident War Room to enrich an indicator. The script is already uploaded and available in the tenant. Which action should the analyst take to execute the script directly from the War Room command line?

An administrator is planning the deployment of Broker VMs to support data ingestion across multiple isolated network segments. Which TWO considerations are critical for proper Broker VM architecture and sizing? (Choose two)

You are writing a custom XQL query to filter logs, but you find that the field names are inconsistent across your data sources. How can you standardize these fields for your automation?

Which THREE configuration steps are typically required when setting up a new Broker VM instance in XSIAM? (Choose three)

An engineer needs to ingest custom JSON-formatted logs from an internal application using an HTTP API. Which XSIAM feature should be configured to receive these incoming webhook payloads?

An XSIAM administrator is configuring a new syslog data source to ingest security logs from an on-premises Linux firewall. Which Collector component must be deployed within the network perimeter to securely forward these logs to the XSIAM tenant?

A Cortex XSIAM engineer is building a playbook that must wait for an external SOC analyst to approve a high-risk containment action before proceeding. The playbook should pause execution and resume only after the analyst submits a response through a form link. Which task type should the engineer add to the playbook to accomplish this?

You are troubleshooting a parsing error where logs from a custom application are not being mapped correctly to the XDM schema. What is the recommended approach to debug the transformation process?

When troubleshooting a failing integration instance in XSIAM, which THREE tools or logs are most useful for diagnosing the root cause? (Choose three)

An XSIAM engineer needs to create a playbook that automatically enriches IP addresses from an incident by querying a threat intelligence integration. The enrichment should only occur if the incident contains at least one IP address. Which playbook task should be used to extract the IP addresses from the incident for further processing?

Which THREE of the following are critical components required for a successful data ingestion integration in XSIAM?

An XSIAM engineer is troubleshooting a newly configured AWS CloudTrail integration. Log data is not appearing in the XSIAM query builder. Which log collection method is natively utilized by XSIAM to pull AWS CloudTrail logs?

A Cortex XSIAM engineer is troubleshooting a custom automation script that runs as part of an incident response playbook. The script intermittently fails with timeout errors when it calls an external enrichment API, and the engineer wants to make the playbook more resilient without changing the external service. Which TWO changes should the engineer make? (Choose two.)

A security engineer needs to create a custom automation script in Cortex XSIAM that will be used across multiple playbooks. The script must be able to call other integrations and process results. Which type of automation should the engineer create?

Which TWO of the following features help maintain data security during the integration process?

An engineer is configuring a webhook integration to forward XSIAM alerts to an external ticketing platform. The external system requires custom HTTP headers for authentication. Where can these custom headers be configured within the integration instance?

An XSIAM administrator is troubleshooting an integration instance that is failing to connect to an external ticketing system. The administrator needs to verify whether the underlying API calls are failing due to invalid credentials or network timeouts. Where should the administrator review detailed debug logs for this specific integration instance?

Which TWO of the following actions can be performed within the Cortex XSIAM Marketplace?

An XSIAM engineer is developing a custom integration that must process a large volume of events. The integration uses a Python script that makes an API call to an external service for each event. The engineer notices that the integration is slow and sometimes times out. The external API supports batch requests, allowing up to 100 events per request. What should the engineer do to improve performance?

An enterprise environment requires all outbound API traffic from XSIAM integrations to pass through an explicit corporate proxy server. Where is the global proxy configuration specified for integration instances?

An engineer is troubleshooting a Cortex XSIAM playbook that fails at a task calling a custom integration command. The command works when run manually from the War Room but fails within the playbook. The playbook task is configured to use the integration instance 'TI-Platform'. Which is the most likely cause of the failure?

An automation engineer wants a playbook to send a notification to a Slack channel only when a critical incident is created. The playbook is triggered by an incident creation event. Which XSIAM playbook task type should be used to conditionally execute the Slack notification task?

A Cortex XSIAM engineer is designing a playbook that must handle a high volume of alerts. The playbook includes a task that calls an external enrichment integration which can be slow or unresponsive. The engineer wants to ensure that a failure in this enrichment task does not halt the entire playbook and that the playbook continues to the next task. Which task configuration should the engineer apply?

An administrator wants to install a new integration pack to automate ticket creation in ServiceNow. Where in the XSIAM interface should the administrator navigate to find and install this pack?

When managing integrations in XSIAM, what is the purpose of the 'Test' button found in the integration instance configuration?

You need to ensure that a specific integration uses a dedicated proxy server to communicate with the cloud. Where is this proxy configuration defined?

An engineer is designing an XSIAM playbook that must delete a malicious file from an endpoint and then verify the deletion succeeded before closing the incident. The vendor's endpoint integration exposes separate 'isolate', 'delete file', and 'list files' commands. Which design approach best ensures the verification step reflects the true post-deletion state?

A Cortex XSIAM engineer writes a custom Python automation that must return a structured result to the playbook so a later conditional task can branch on a specific field. The engineer wants the returned data to be accessible as a named output rather than only as raw command output. Which action should the script take to expose the value?

Which TWO methods are supported in XSIAM for forwarding alerts or incident details to external SIEM or ticketing systems? (Choose two)

Which THREE best practices should be followed when designing custom automation integrations and playbooks in XSIAM? (Choose three)

An engineer has a Cortex XSIAM playbook that enriches alerts by querying an internal CMDB through a REST API integration. The integration instance is configured and passes connectivity tests, but during playbook execution the enrichment task returns an authentication error only when the playbook is triggered by an alert from a specific data source. The same task succeeds on every other trigger. What is the most likely cause?

An XSIAM engineer is configuring an integration instance for a third-party threat intelligence platform. The integration requires authentication and the engineer wants to ensure that the credentials are handled securely and that the instance can be used by playbooks. Which two actions should the engineer take? (Choose two.)

An engineer is mapping a non-standard third-party security log source into the XSIAM Common Data Model (XDM). Which tool within XSIAM should be used to define custom parsing rules and field mappings?

Which protocol is natively supported by the Broker VM Syslog collector for receiving log streams from network devices?

An engineer is building a Cortex XSIAM automation that must call an external REST API. The API requires a static API key that must never appear in playbook exports, task inputs, or the war room. The key must also be usable by multiple playbooks and be rotatable without editing any playbook. Which mechanism should the engineer use to store and reference the API key?

Which THREE of the following are benefits of using the XDM (eXtendable Data Model) in Cortex XSIAM?

When setting up a new Data Collector, you need to ensure high availability for log collection from a remote site. What is the best practice for deploying the collectors?

An enterprise security team wants to ensure that all data ingested from a specific untrusted data source is automatically tagged with a specific tag for downstream analytics. Where can this automatic tagging rule be applied during integration setup?

Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)

Which TWO actions can an administrator perform when managing integration instances within XSIAM? (Choose two)

An administrator is setting up an integration with a third-party threat intelligence platform using Cortex XSOAR capabilities embedded within XSIAM. The integration instance requires periodic polling to fetch newly published Indicators of Compromise (IoCs). Where should the administrator configure the fetch interval?

An XSIAM engineer wants to test a new automation script that parses indicators from an external threat feed. The script should run automatically every hour. Which XSIAM feature should be used to schedule this script?

An automation engineer is building a custom Python integration in Cortex XSIAM that must retrieve a list of indicators from an external threat intelligence platform. The platform's API returns a JSON object with a nested array under the key 'data'. The engineer wants the integration command to output a clean list of indicators that can be used in subsequent playbook tasks. Which approach should the engineer take to parse the API response and return the indicators?

A Cortex XSIAM engineer deploys a new custom integration that calls an internal ticketing API. The integration works when tested from the engineer's workstation but fails inside XSIAM with connection errors, and the API requires a client certificate that the engineer generated locally. What should the engineer configure to let the integration present that certificate?

An automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be used to execute commands against the Cortex XSOAR/XSIAM engine?

Which THREE security considerations are critical when configuring third-party integrations and API keys in XSIAM? (Choose three)

An XSIAM administrator is configuring a new API-based integration to ingest threat intelligence feeds. During configuration, what credential type is most commonly required by modern token-based REST API integrations?

A Cortex XSIAM engineer needs an automation to run every time a new alert is created, before any analyst reviews it, so that enrichment and severity scoring happen automatically. The engineer wants the automation to execute based on the alert's attributes without a human starting it. Which trigger mechanism should be used?

An automation playbook fails because the JSON response from an API call contains nested objects that are not being parsed correctly. What is the best way to handle this in a playbook?

Which THREE parameters can be configured when setting up a log ingestion parsing rule in XSIAM? (Choose three)

A security analyst needs to automate a recurring task that involves enriching alerts with data from a third-party threat intelligence platform. Which component of XSIAM is specifically designed for this cross-platform workflow?