Certified XSOAR Engineer (XSOAR-Engineer) (XSOAR-Engineer) — Questions 76–150

Before building the playbook, the engineer must ensure the integration has the required permissions to perform isolation and collect forensic data. Without proper API permissions, the playbook tasks will fail. This step is foundational for the use case to function correctly and is a prerequisite for automation.

Creating a sub-playbook for IP enrichment promotes reusability across different incident types. By accepting an IP as input and returning results, it can be invoked from any playbook, reducing duplication and simplifying maintenance. This is a best practice for modular playbook design in XSOAR.

A custom dashboard with a table widget allows filtering incidents by assignee and severity, providing a real-time view of open high/critical incidents assigned to the analyst. This is a built-in feature that requires no coding and can be shared or set as default, making it the most efficient solution for the requirement.

Each War Room entry has a context menu accessed via the three-dot icon, which includes 'Add Tag'. This applies a user-defined tag directly to that entry, enabling later filtering by tag. It is the intended mechanism for labeling individual entries in the incident's War Room timeline.

Cortex XSOAR applies type-specific normalisation rules, such as lowercasing domains, before merging duplicate indicators into a single entry. This satisfies the stem's mixed-case feed scenario, preventing redundant indicators that would otherwise inflate counts and skew enrichment.

A full backup of the database and configuration is essential before any version upgrade. The built-in backup or a supported snapshot captures incidents, playbooks, integrations, and settings, allowing rollback if the upgrade fails. Without a verified backup, a failed upgrade could result in irreversible data loss, making this a mandatory pre-upgrade step for production maintenance.

Pre-conditions and filtering rules on the task's Conditions tab evaluate the previous task's verdict before execution, so the task runs only when that verdict equals 'Malicious'. This satisfies the stem's conditional-execution requirement without altering the playbook's overall flow.

A clear, descriptive name states the playbook's workflow purpose, letting analysts identify its function in the playbook library before running it. This satisfies the organisation-wide publishing requirement for discoverability and consistent, unambiguous reuse across teams.

The engine initiates a connection to the Cortex XSOAR server to receive tasks and send results. This communication typically occurs over port 443 (HTTPS). Therefore, outbound access from the engine to the server on port 443 is required. Without this, the engine cannot register or operate.

Dashboard widgets query underlying indices through the viewer's role, so missing permissions on those data sources cause load failures. Verifying the role's index and incident access directly addresses the authorisation constraint in the stem, rather than widget code or engine health.

External products reject unauthenticated calls, so the instance requires valid credentials — API keys, tokens, or username/password — matching the target's auth scheme. This satisfies the stem's connection requirement by proving identity to the firewall or SIEM before any command executes.

Cortex XSOAR refreshes an indicator's expiration timer whenever the feed sees it again, so the 30-day window restarts on each observation. Indicators persist if the feed keeps returning them, and they expire only after the configured period with no sightings. Reputation is the combined DBotScore across all sources, so a Good score from another integration can outweigh or blend with the Bad score from this feed, producing a Good reputation.

Trust level adjusts the weight applied when aggregating source reputations into an indicator's score. Marking a feed Good raises its contribution, so a conflicting malicious feed with lower trust may be outweighed, leaving the indicator scored as benign rather than malicious.

The War Room is the incident's centralised collaboration and audit workspace, capturing analyst notes, executed commands and playbook task results in real time. It satisfies the requirement for a single chronological audit trail by recording every action against the incident as it happens, rather than scattering evidence across separate tools.

Cortex XSOAR exports playbooks as JSON files, which capture the full task graph, inputs, and configuration needed to reimport the playbook on another server. This format supports backup and migration because it preserves structure and is portable across XSOAR instances.

`demisto.args()` returns the command arguments supplied at runtime, satisfying the need to read inputs passed into an integration command. It is the standard Demisto API accessor for script parameters, letting the automation consume values such as indicators or incident fields without hard-coding them.

Auto-extraction settings ensure extracted values become formal indicators in XSOAR.

Report templates (often Word/DOCX based or HTML) can be uploaded and customized under the Reports section.

PostgreSQL replication and Elasticsearch synchronisation preserve incident data, playbooks and indexes across nodes, which the HA/DR requirement demands for seamless failover. Without synchronised database and search layers, a standby engine cannot resume active incidents or automation state, so this component must be planned first.

The Source parameter on a feed instance specifies the source label attached to every indicator ingested by that feed. When an indicator already exists, this source is added to its list of sources, linking it to the new feed. Reviewing and setting this parameter correctly ensures existing indicators are associated with the feed's source.

Cortex XSOAR provides a built-in backup and restore feature that captures the database (including incidents, playbooks, and configurations) and relevant files. This is the recommended method for a consistent full-system backup. It ensures that all components are backed up together and can be restored reliably, meeting the administrator's requirements.

The attachment argument expects the context path to the file's entry ID, not the file object itself. ${File.EntryID} resolves to the stored file identifier that XSOAR retrieves and attaches, so the email task can access the artefact generated earlier.

Cortex XSOAR playbooks are directed acyclic graphs by default, so backward movement requires explicit constructs. Loop Tasks or conditional branches wired to earlier task nodes provide that return path, letting a False Positive click route execution back to the cleanup task.

XSOAR uses Docker containers to run integrations and automations in isolated environments. Therefore, a supported container runtime, such as Docker, must be installed and running on the host. This is a fundamental prerequisite for the server to execute containerized content, directly addressing the requirement.

The WorkArea search bar accepts Lucene-style field queries, so 'owner:me and status:Investigation' filters incidents on both the owner and status fields simultaneously. This satisfies the analyst's need to isolate their own incidents currently in Investigation status, returning the precise subset directly rather than requiring manual sorting or separate filters.

Error handling and alternative paths directly satisfy the maintainability constraint: timeout and failure branches prevent a single integration outage from halting the entire playbook, keeping execution predictable. Explicit branches also document expected failure modes, so later engineers can read and modify the workflow without reverse-engineering implicit behaviour.

XSOAR provides a built-in backup and restore feature that captures custom content, configuration, and the database. Using this mechanism ensures a consistent snapshot that can be restored after a failed upgrade. It includes playbooks, automations, integrations, and system settings, making it the most reliable way to meet the requirement.

The failure stems from Cortex XSOAR's trust store not recognising the feed's self-signed certificate. Disabling SSL verification on that integration instance bypasses validation, while importing the issuing CA into the trust store establishes a valid chain, both restoring the scheduled feed.

Ticketing integrations such as ServiceNow or Jira are native XSOAR tasks that create tracked summary tickets, satisfying the requirement to notify stakeholders outside the SOC. Management reviews and audits these tickets within existing ITSM workflows, providing an auditable distribution channel.

Management rules support conditions and actions such as tagging, and expiration rules can be scoped to exclude tagged indicators. A high-priority rule that tags the internal feed indicators and an expiration rule that skips tagged indicators together prevent automatic expiry. This directly and explicitly protects the indicators as required, making it the correct configuration.

Cortex XSOAR extracts indicators during incident creation using extraction rules that map regex patterns to indicator types. For a custom type, you define a regex in the extraction configuration and link the reputation command to the indicator type so the platform knows how to enrich it. This combination enables automatic identification of CryptocurrencyAddress values in incident evidence and triggers the associated reputation command, updating the indicator's DBotScore without manual analyst action.

Creating a sub-playbook centralizes the common logic, making it reusable across multiple parent playbooks. Each phishing incident playbook can invoke the sub-playbook, ensuring consistent enrichment and scoring. This modular approach simplifies maintenance and updates, as changes are made in one place. It directly addresses the requirement for reusability without duplication.

Cortex XSOAR supports @-mentions in War Room entries. Typing @ and selecting the username notifies that user and links the mention to their account, which is the standard way to draw a teammate's attention within an incident.

Many task types in Cortex XSOAR support a 'Run if' condition, which allows you to specify an expression that determines whether the task executes. You can set this condition to evaluate the indicator's reputation, so the task only runs when the reputation matches 'Bad' or 'Suspicious'. This is a simple way to conditionally execute individual tasks without a separate branching task.

The lookback period (first fetch) defines the historical window queried on the integration's initial run, satisfying the requirement to pull past indicators. Subsequent scheduled fetches use the last-run timestamp instead, so only this parameter governs how far back the first ingestion reaches.

Manual tasks in XSOAR pause the playbook and wait for a human to complete the task, which can include entering a value or selecting an option. The playbook state is preserved, so when the analyst completes the task hours later the playbook resumes automatically. This is the native mechanism for approval gates in a use case.

Bulk tagging and reputation updates operate directly on selected indicators within the Threat Intel workspace, satisfying the stem's requirement for actions available when managing indicators. This mechanism lets administrators apply consistent classification and scoring across many indicators at once, rather than editing each individually, which the workspace explicitly supports.

Sub-playbook outputs are not automatically available in the parent context. The engineer must explicitly map outputs in the sub-playbook task configuration, specifying a key in the parent context. Once mapped, the parent can reference that key, e.g., ${ParentKey}. This ensures the data is correctly passed and accessible. This is the correct approach for accessing sub-playbook results.

Task border colours map to execution state: green for completed, red for failed or errored, blue for in-progress or pending. This lets analysts watching an active incident see at a glance which playbook tasks succeeded, which broke, and which are still running.

The related incidents list surfaces other incidents sharing the same indicators, letting analysts pivot from a threat-feed indicator to prior or concurrent investigations. This correlation satisfies the stem's requirement for investigating indicators drawn from threat feeds.

Engines initiate outbound connections to the XSOAR server on the configured port (default 443) and authenticate with an engine key. This design requires no inbound firewall openings, exactly matching the scenario. The server does not need to reach back to the engine, so outbound-only rules are sufficient for registration and operation.

Fetch interval frequency governs how often the integration polls the REST endpoint, satisfying the requirement for a scheduling parameter. Generic REST feeds need this to control data ingestion cadence, as Cortex XSOAR cannot infer polling timing from the API itself. It is distinct from authentication and endpoint URL parameters, which define access rather than retrieval timing.

The join transformer concatenates elements of an array into a single string, using a specified delimiter. By default, it uses a comma. Applying join to the 'EnrichedIndicators' list will produce a comma-separated string of indicator values, which is exactly what the subsequent task requires. This is the correct transformer for this conversion.

Well-defined, repeatable steps governed by a standard operating procedure let XSOAR codify each action as deterministic tasks, commands, and playbook branches without ambiguous judgement calls. This directly satisfies the stem's automation-candidacy constraint: predictability enables reliable execution, whereas ad-hoc or judgement-heavy processes resist scripting and produce brittle playbooks.

Cortex XSOAR provides a built-in backup and restore feature that captures the full server state, including incidents, playbooks, integrations, and system settings. This backup can be restored to another server, making it the correct method for disaster recovery. It is designed specifically for this purpose and ensures consistency.

A line chart is ideal for displaying trends over time, such as incident resolution times. It can plot metrics like average resolution time per day or week, allowing the administrator to identify patterns and anomalies. This widget type directly supports the requirement to monitor trends in incident resolution performance.

A Join task is designed to synchronize multiple parallel branches. It waits until all incoming branches have completed before continuing. In this scenario, after the parallel tasks finish, the Join task aggregates their outputs and allows the playbook to proceed with a single consolidated flow, exactly as needed.

Parallel branching from a single parent task dispatches all three threat intelligence enrichment tasks concurrently rather than sequentially. This removes cumulative wait time, since each TIP query runs independently, cutting total playbook execution time to the duration of the slowest enrichment instead of the sum.

Source trust levels and weights directly determine how much each feed's verdict contributes to the aggregated reputation calculation. When feeds conflict, Cortex XSOAR applies the configured reliability weighting per source, so a higher-trust feed's malicious verdict outweighs a lower-trust feed's benign verdict, satisfying the stem's requirement to resolve conflicting data.

Incident deduplication and matching rules compare incoming alerts against existing open incidents using defined fields, merging recurring findings for the same asset into the original incident rather than creating new ones. This directly prevents the incident fatigue described, where thousands of hourly alerts would otherwise flood analysts.

A context transformer or custom mapper in the task's Edit Outputs section rewrites the returned 'IPAddress' key to 'IP' during output mapping, so downstream playbook tasks and naming conventions resolve correctly. This satisfies the constraint of transforming the output without modifying the integration code itself.

Task descriptions and notes attach directly to individual playbook tasks via the properties drawer, so the conditional branch's business logic stays visible in the design canvas where colleagues review it. This satisfies the requirement to document complex branching without leaving the design interface, unlike external wikis or comments stored outside the playbook itself.

Cortex XSOAR allows administrators to upload custom CA certificates to the trusted store via the 'Certificates' page in Settings. Once imported, the integration can validate the server's certificate without disabling SSL verification. This maintains secure communication and resolves the verification error. It is the recommended approach for self-signed certificates in production.

Defining expression rules on the task's Conditions tab gates execution directly on the incident severity field, so the task runs only when severity equals High or Critical. This satisfies the stem's constraint precisely: conditional task-level filtering, evaluated before the task executes, rather than playbook-wide triggers or separate routing rules.

Analyst notes and comments are captured directly in the War Room, creating a shared, timestamped record that satisfies the requirement for collaborative investigation within the incident. This keeps discussion attached to the incident itself rather than external channels, so responders can review reasoning and evidence alongside the artefacts and tasks already surfaced there.

Cortex XSOAR ingests file hashes (MD5, SHA1, SHA256) as indicators out-of-the-box, mapping them to the File indicator type for reputation lookups and enrichment. This native support lets analysts correlate hash-based threat intelligence without custom parsing or integration development.

Cortex XSOAR requires sufficient disk space for its database, Docker images, and logs. Best practices recommend SSD storage for performance, and 500 GB is a common minimum for production deployments. This allocation ensures that the server can handle data growth and container images without running out of space.

Dashboard widgets support queries that run against incident data, and a Pie chart can group results by a field such as severity. By scoping the query to open incidents from the current week, the widget shows the required breakdown and refreshes as incident data changes. This matches the grouping and automatic-update requirements.

The Marketplace retains prior pack versions, so selecting the pack and downgrading restores the previous schema immediately without rebuilding scripts or playbooks. This directly satisfies the stem's fastest-revert constraint, since the breaking schema change is undone at source rather than patched downstream.

MTTR captures the elapsed time from phishing alert detection to full resolution, giving the exact manual baseline needed to quantify automation gains. Without this figure, the team cannot measure whether the playbook reduces triage and resolution effort, making it the critical metric for this use case.

The Work Plan tab renders the playbook as a structured task tree with each task's status, start and end times, and the inputs and outputs captured during execution. Reviewing it for a completed phishing incident lets the analyst confirm the exact order of automation steps and inspect what each task returned, which is precisely the step-by-step record being requested.

Reports are generated from Dashboards > Reports, where the analyst selects a report template and defines the timeframe. This location produces the PDF containing aggregated metrics such as incident closure rates for the last month, matching the stem's reporting requirement.

Incident Info section layout is governed by the incident type's layout configuration. Settings > Customization > Layouts lets the administrator assign custom fields to the section, and applying it to the phishing incident type makes those fields appear for all phishing incidents.

Performing the WHOIS lookup inside the feed integration's fetch logic lets the engineer validate each indicator before it is returned to the platform for storage. Indicators that fail enrichment are simply not emitted, satisfying the block-on-failure requirement. Because the feed integration controls what reaches the indicator database, this is the only listed approach that can truly prevent storage of unenriched indicators.

The Outputs section of a playbook task lets you define context keys and map them to values from the command result using the integration's documented context path. This stores only the desired nested field, keeping the context clean and making it easy to reference later. It is the standard way to extract specific data from a command's output.

Cortex XSOAR evaluates the task's conditional expression against the current incident context at runtime; if the expression resolves false, the task is skipped. This context-driven evaluation, not playbook order or manual input, determines whether the task executes.

Conditional tasks in XSOAR can evaluate built-in task fields such as the error state alongside the returned value. By checking whether the integration task failed before evaluating the risk score, the playbook can route to an escalation or retry branch instead of falling through to a default branch. This explicitly handles the HTTP 500 failure case the engineer is concerned about.

PagerDuty integration tasks invoke the on-call escalation service directly, so placing them on a high-priority routing path pages the engineer without waiting in the standard queue. This satisfies the requirement that critical SIEM alerts bypass normal triage and trigger immediate notification.

Using port 443 with SSL ensures secure communication between the engine and the main server. This is the default and recommended method for engine-server communication, providing encryption and authentication. It also simplifies firewall configuration, as port 443 is commonly open. This action directly addresses the requirement for reliable and secure connectivity.

A Section of type Query pulls data from a saved War Room query and renders it as the chosen widget, which is exactly how dynamic War Room content is embedded. Other section types cannot execute saved queries.

A prompt task pauses playbook execution and presents analysts with a question or list of indicators, collecting their decision before the workflow resumes. Conditional, manual, and data-collection tasks cannot halt the run and return a human choice, so the prompt task satisfies the review-and-decide requirement.

Storing cursor timestamps via demisto.getLastRun() and demisto.setLastRun() satisfies the requirement to persist pagination state across polling intervals. XSOAR restores this dictionary at each fetch-incidents execution, so the integration resumes from the last processed timestamp marker rather than refetching or skipping incidents.

Conditional tasks branch playbook execution based on defined criteria, evaluating inputs to route the flow down different paths. This satisfies the stem's requirement for a valid task type in the Cortex XSOAR visual designer, since branching logic is a core built-in task category alongside automation and manual tasks.

Server logs such as demisto.log capture Python tracebacks and runtime errors from the automation script, revealing argument-parsing failures or exceptions. Reviewing them exposes the actual execution error, satisfying the need to diagnose why expected arguments never reached the script.

This approach uses one conditional task with a compound condition that evaluates whether severity is Low or Medium. If true, it assigns to Tier1; otherwise, it assigns to Tier2. This efficiently handles all four severity levels without redundant tasks, reducing playbook complexity and maintenance.