Certified XSOAR Engineer (XSOAR-Engineer) (XSOAR-Engineer) — Questions 1–75

The War Room input box accepts free-text entries that become notes attributed to the analyst with a timestamp. Pressing Enter posts the remark to the shared conversation, making it visible to every team member reviewing the incident. No command execution is involved, which matches the requirement exactly.

A standalone Task executes a direct command or inline Python script when no out-of-the-box integration task exists. It satisfies the constraint of running an arbitrary integration command by letting the engineer specify the command and its arguments manually within the playbook.

TIM supports exclusion lists that prevent matching indicators from being ingested or from receiving a malicious reputation. By adding the scanner range to an exclusion list and attaching it to the relevant feed instances, the engineer guarantees those IPs are never marked bad, regardless of what any public feed reports. This directly satisfies the requirement.

Roles bind users to granular permissions covering incident types, war room access, and settings, which is the foundation of RBAC in a multi-team SOC. Assigning users to roles enforces least privilege and separates each team's data and configuration access.

A polling loop with a wait task periodically queries the sandbox job status, releasing the execution thread between checks. This handles the 2-to-15-minute asynchronous delay without blocking a thread, satisfying the requirement to avoid locking up execution.

A conditional task allows the playbook to evaluate a condition and branch to different paths based on the result. In this scenario, the condition can check the incident severity and direct the flow to the appropriate response tasks. This is the standard way to implement branching logic in XSOAR playbooks.

Cortex XSOAR supports SAML SSO by allowing administrators to upload the identity provider's metadata XML. This metadata contains the necessary endpoints and certificates for establishing trust. Uploading it in the SAML configuration section is the correct step to enable SSO.

Execution logs capture the raw HTTP response, status codes and parser exceptions for each fetch, revealing malformed fields, unexpected schemas or authentication failures. This pinpoints whether the feed's incoming data or the integration's parsing logic causes the failure.

This task passes the custom field value through the ${incident.affectedhost} placeholder and uses continueonerror so a CMDB outage does not halt the playbook. Running it as a single playbook task ensures it executes once per incident. This directly satisfies the non-blocking enrichment requirement while using the supported XSOAR command argument and error-handling mechanism.

'ToLower' is a built-in Cortex XSOAR transformer that converts string characters to lowercase within context expressions, enabling case-insensitive comparison and normalisation during playbook data transformations. It operates directly on string values in the context path.

Incident SLAs define a 72-hour response target, and SLA breach actions fire automatically when that timer expires, applying the escalation and tag without manual intervention. Timer and scheduled automation rules execute this logic at the defined threshold, satisfying the stem's time-based escalation constraint.

Cortex XSOAR allows you to define triggers for playbooks that specify conditions based on incident fields such as type and severity. By setting the trigger to 'Automatic' and adding conditions for incident type 'Phishing' and severity 'High', the playbook will only run when both conditions are met. This is the standard method for conditional automatic execution.

Cortex XSOAR supports API keys generated within each user's profile settings, which clients such as SIEMs and custom scripts present directly on REST API calls. This satisfies the stem's requirement for a supported authentication method without exchanging interactive credentials for a session.

Cortex XSOAR natively forwards audit and system logs to external collectors via Syslog over TCP or UDP, configured under Server Configuration. This built-in mechanism lets an external SIEM ingest health and performance telemetry without custom integrations.

Tenant management, or RBAC combined with incident query filters and role-based permissions, restricts each department to its own incidents and playbooks within the shared instance. Server-level separation or separate instances would isolate data absolutely but defeats the stated requirement to share one XSOAR instance.

When multiple feeds update the same indicator, Cortex XSOAR recalculates the score from the latest feed data by default. If Feed A and Feed B run in an alternating or nondeterministic order, the indicator's reputation flips between Bad and Benign-derived values. The fluctuation reflects feed execution order rather than analyst action, which matches the observed pattern.

This approach directly addresses both failure points: a conditional task prevents errors when no attachments exist, and 'continue on error' with retries ensures the playbook proceeds if the firewall is temporarily unreachable while attempting to block hashes. It balances robustness with automation, aligning with resilient playbook design in XSOAR.

Reviewing instance debug logs captures Python stderr from the integration's execution inside the Docker container, exposing import errors, missing dependencies or tracebacks that the engine's own logs omit. This directly satisfies the stem's need to isolate container execution failure, since stderr is streamed from the container process to the instance log.

This approach directly implements the required logic using the conditional task, which evaluates the incident fields and custom fields. The condition checks both severity and the presence of malicious attachments, ensuring the notification is sent only when both criteria are met. This is the most straightforward and maintainable method in XSOAR.

Severity is a standard incident field with defined values, and widget queries support filtering or grouping on it, allowing dashboards to surface critical incidents. This meets the requirement for a categorisation attribute in custom widget queries.

Non-standard JSON nests indicators unpredictably, so correct JSONPath expressions are essential to extract each field reliably. Without accurate paths, the parser returns nulls or wrong values, breaking indicator ingestion before any schema mapping can occur.

The War Room search box filters the timeline by keyword, command name, or analyst, letting the analyst jump directly to the containment command entry. For a closed incident with hundreds of entries, this is the fastest way to locate the specific execution and its associated user and timestamp.

Remote engines run integrations inside isolated network segments, reaching internal systems that the central server cannot access directly, then relay results back over an outbound connection. This satisfies the requirement to operate across isolated regional zones without inbound firewall openings.

A condition task in XSOAR allows you to define logical expressions based on incident fields, context data, or task outputs. By referencing the custom field 'incidentseverity', the playbook can automatically evaluate its value and route execution to the correct sub-playbook. This is the standard method for implementing conditional branching in playbooks.

The Indicator Details page in Cortex XSOAR includes a Sources section that enumerates every feed or integration that contributed to the indicator's aggregated score, showing each source's individual reputation value. This lets the analyst trace a score of 3 back to its originating feed and decide whether that feed is trustworthy before acting on the indicator.

Cortex XSOAR resolves ${Email.Body} at runtime by reading the value from the incident context, substituting it into the argument field when the task executes. This passes the dynamic email body content into the integration command without hard-coding values.

Selecting URL stores each feed entry as a URL indicator, letting Cortex XSOAR match, extract and enrich malicious web addresses directly against that indicator type. This satisfies the stem's constraint of supplying malicious URL strings, since the URL type applies URL-specific regex extraction and reputation commands rather than treating entries as generic domains or files.

Prioritising high-volume, low-complexity use cases delivers rapid automation wins, reducing analyst workload early. This satisfies the best-practice constraint of demonstrating value quickly during a first XSOAR rollout, building stakeholder confidence before tackling intricate playbooks that demand more engineering effort.

The Owner dropdown in the incident header lets an analyst assign the incident to themselves directly, satisfying the requirement to reassign from the incident view without navigating elsewhere. This updates ownership in place, reflecting the analyst as the responsible party.

A conditional task evaluates a custom condition using the current incident context at runtime, allowing the playbook to branch based on computed values like severity. It supports multiple conditions, each leading to a different next task, which directly satisfies the requirement for dynamic branching based on the script's output.

Correlation depends on indicator matching being enabled and the incident type being configured to correlate indicators. If matching is disabled globally, or the incident type lacks that configuration, fetched indicators exist but never trigger correlation when matching observables appear in new incidents.

Content pack upgrades overwrite the pack's original playbooks, discarding direct edits. Cloning creates a separate custom playbook outside the pack's managed content, so your modifications persist through upgrades while the original remains available for reference or future pack improvements.

Scheduled reports require recurrence settings (e.g., daily, weekly) to trigger automatically.

Threat Intel Dashboards in the Overview workspace aggregate indicator counts, type breakdowns, and top malicious sources from the threat intel database, directly satisfying the stem's requirement for summary metrics. Unlike the Indicators page, which lists individual records, dashboards present pre-computed visualisations without manual querying.

The Tags parameter on a feed instance accepts a comma-separated list of tags that are automatically applied to every indicator ingested by that feed. This directly fulfills the requirement to tag indicators from the MISP feed for filtering and correlation. Tags are searchable and can be used in indicator queries and playbooks.

The Tags field on the incident Details tab is designed for free-form labels that analysts can add or remove. Saving the incident persists the tag, and other users can then search for it using the tags filter in the Incidents page. This directly enables the quick filtering and discovery the scenario requires.

Source weights in Indicator Scoring settings let you assign Feed A a higher reliability value than Feed B, so its reputation dominates when the two contradict. Precedence resolves the conflict deterministically, stopping the indicator's score from oscillating between malicious and benign as each feed refreshes.

The TAXII Server URL, whether discovery or collection endpoint, is mandatory so Cortex XSOAR knows where to poll STIX objects. It satisfies the stem as one of the two required advanced configurations, defining the feed's source before authentication is applied.

Context syntax such as ${incident.ipaddresses} resolves the incident field at runtime and passes its current value into the sub-playbook input, so the dynamic list of IP addresses is transferred correctly rather than a static literal.

A conditional task evaluates the indicator's score field and controls task routing based on the result. By placing it before the enrichment and branching only for Suspicious or Bad scores, the playbook guarantees the premium enrichment runs exclusively for those indicators, avoiding unnecessary API calls and cost.

The Playbook Description field stores free-text documentation visible to analysts in the playbook library, recording what the playbook does and how it flows. It carries no execution logic, so it serves purely as human-readable context for the workflow.

The Indicators page supports exporting selected indicators, and STIX or CSV output contains only indicator data. This shares exactly the required indicators without notes or timeline entries. The partner can then import the STIX or CSV into their own Cortex XSOAR instance, satisfying both the content restriction and the interoperability requirement.

Cortex XSOAR's Server Configuration includes SMTP settings where you specify the server address, port, and credentials. This is the standard method to enable email notifications for incidents. Without these settings, the server cannot authenticate to the internal SMTP server and send notifications.

Setting the Owner field to the shift lead transfers incident ownership, triggers an in-app notification, and makes that user the acknowledged owner. This is precisely what is needed for an 8-hour handoff on a malware containment incident, ensuring the on-call lead is accountable during the shift.

Conditional tasks in XSOAR playbooks allow branching based on task outputs or incident fields. By using a conditional task, the engineer can define a condition that checks if severity equals High and the source IP is not in internal ranges, then route execution to the enrichment task only when true. This is the native and most maintainable way to implement such decision logic.

Tabs are a core layout component, letting engineers group related incident fields, sections and widgets across separate views within the custom incident layout. This directly satisfies the stem's requirement to identify includable components, since Cortex XSOAR's layout editor exposes tabs as a configurable structural element alongside sections and fields.

The engine authenticates to the primary server using a communication key generated on the Cortex XSOAR server and applied during engine configuration. Without this shared key, the engine cannot establish trust through the load balancer, so it is a required step.

Parallel fan-out connections let the three enrichment tasks run concurrently, then converge into the joining analysis task. This satisfies the stem's requirement to execute Active Directory, Threat Intel and DNS lookups simultaneously before proceeding, rather than sequentially.

The report content must be scoped to VIP-labeled incidents from the prior week, so an incident filter combining the VIP label and a rolling date range is required. Without this filter, the report would include unrelated incidents and fail the manager's content requirement.

Cortex XSOAR provides an Audit Log under Settings that captures user activity, playbook executions, and configuration changes with timestamps and user attribution. This is the built-in compliance and troubleshooting resource. It is distinct from incident war rooms and system logs, and it is the correct place to review an audit trail for compliance purposes without accessing the underlying operating system.

Custom tabs group related incident fields into named sections such as Triage and Containment, so analysts navigate fewer screens and enter data faster. This directly satisfies the stem's workflow and data-entry efficiency constraint by restructuring the layout rather than altering underlying incident data.

The requirement is to open a case when an incident is created and close it when the incident is closed. These correspond directly to the incident creation and incident closure lifecycle events, which playbooks can trigger on. Mapping both events ensures the external case stays synchronized with the XSOAR incident throughout its life.

A For-each task iterates over a list and executes its sub-tasks for each item. You can specify the list from context (e.g., ${IPs}) and the loop will run the reputation check and note-adding tasks for each IP. This is the designed way to perform repetitive actions on a collection of items within a playbook.

Disabling a confirmed-malicious Active Directory account outside business hours suits full automation because the action is deterministic, reversible and time-critical, and no analyst is available to approve it. The confirmed-malicious constraint removes ambiguity, so the playbook can act immediately without human judgement.

An Engine runs integrations and playbook tasks inside remote network segments, so it reaches isolated or restricted assets without exposing the main server. It also distributes execution load away from the central server, satisfying both the segmentation and load-reduction constraints in the scenario.

Integration dependencies or required integration commands must be verified because a playbook's tasks invoke specific commands that only exist when the corresponding integrations are installed and enabled. Without these references, the pack installs but tasks fail at runtime in the target production environment, since XSOAR cannot resolve commands absent from the tenant.

The Health Check integration probes platform operational metrics, including CPU and memory usage, database connectivity and disk space, surfacing degradation before it affects incident response. This satisfies the requirement to monitor system resources and database connectivity across the Cortex XSOAR deployment.

Incident layout validation or closing rules enforce mandatory fields at closure, blocking the close action until closeReason is populated. This satisfies the requirement that closure reasons be mandatory whenever an incident is closed, without relying on analyst discipline.

A playbook task of type 'War Room entry' can run commands like !domain and use the returned context to build markdown. When the Phishing playbook triggers on incident creation, the task executes automatically and posts the result into the War Room without analyst intervention. This satisfies both the automatic execution and the per-incident sender domain reputation requirement.

The ${} syntax resolves values from playbook context at runtime, letting a task argument inherit output from prior tasks or incident fields. This dynamic binding satisfies the requirement to pass computed or upstream values into command arguments without hardcoding.

Reputation is the global scoring attribute XSOAR uses when evaluating indicators, so setting it to Benign or False Positive stops the indicator from triggering detections across all integrations and playbooks, neutralising the false positive without deleting the indicator.

A playbook can include a task that triggers when the incident is closed, such as a conditional task based on the incident status. This task can run a script or integration command to generate a summary report and attach it to the incident. This is the most flexible and standard way to automate post-closure actions in Cortex XSOAR.

A messaging integration task pushes real-time alerts to a Slack or Teams SOC channel, satisfying the requirement for immediate desktop notification when a critical incident needs manual intervention. This delivers analyst-facing alerts directly rather than relying on dashboard polling.

TCP 443 carries the HTTPS traffic the engine requires to reach the Cortex XSOAR server, satisfying the strict-firewall constraint in the stem. Because the engine initiates all communication outbound over TLS on this single port, no additional inbound rules are needed, and firewall policy can remain restrictive.

Sub-playbooks are designed for reuse. By encapsulating the shared tasks in a sub-playbook, multiple parent playbooks can call it, ensuring consistent logic and reducing maintenance. Changes made to the sub-playbook automatically apply to all callers, which is the most efficient approach for the scenario described.

Report templates let the engineer define exactly which sections and fields are rendered, so the output can include incident metadata, a playbook task summary, and closing notes while deliberately omitting raw command results. This gives precise control over the artifact's contents and readability. Combined with report generation from the incident, it satisfies the scenario's curation requirement.

A Conditional task can evaluate the output of the integration task. You can write a condition that checks if the indicator list exists and has a length greater than zero. If true, the playbook branches to the desired path; if false, it can follow an alternative path. This provides the required branching based on the result.

When an engine shows as disconnected despite network connectivity, common causes include authentication failures, expired certificates, or misconfigured engine keys. Reviewing the engine logs (e.g., /var/log/demisto/engine.log) can reveal specific errors such as 'invalid token' or 'certificate verify failed'. This is the logical next step to pinpoint the root cause.

XSOAR supports dynamic input substitution using the ${} syntax. By referencing ${incident.sourceip}, the playbook can retrieve the value of the custom field 'sourceip' and pass it to the integration command. This is the standard way to use incident data as inputs for tasks, enabling dynamic enrichment based on incident context.

Masking within the script prevents PII from ever reaching context or incident fields, satisfying the compliance constraint at the point of creation rather than relying on later cleanup. XSOAR persists context data automatically, so sanitising outputs before writing is the only reliable way to avoid long-term storage.

Built-in export features push indicators outward through integration instances such as Filebeat, Syslog, or API export, satisfying the requirement to move threat indicators from Cortex XSOAR into external systems. These mechanisms operate at the integration layer, forwarding enriched indicator data to SIEMs, log platforms, or third-party APIs without custom development.

Dashboard widgets execute their saved query on each render, so an overly broad time range or loose filter forces a large scan. Narrowing the range and tightening filter criteria reduces the data the query returns, cutting widget latency and dashboard lag.

Integration instance configuration filters and mapper settings operate during ingestion, before incident creation. Instance filters drop or route raw events at the fetch stage, while mappers transform incoming fields into incident schema. Together they satisfy the stem's constraint of filtering or modifying raw events prior to official incident creation in XSOAR.

A Conditional Task evaluates the severity value returned in context and routes execution down the matching branch, letting the playbook invoke different sub-playbooks per severity level. It is the built-in component designed for exactly this branching logic.

Incident Layouts define which fields and sections appear on the incident screen, and custom fields store the hash, machine name and containment values. Configuring both together places those elements in the analyst's immediate view, meeting the visibility requirement.