Certified XSOAR Engineer (XSOAR-Engineer) (XSOAR-Engineer) — Questions 226–273

Filtering in indicator extraction settings or playbook conditional checks against RFC 1918 private ranges and loopback addresses prevents internal IPs from reaching external threat intel APIs, satisfying the exclusion requirement before any enrichment query is issued.

A SIEM integration instance is the native ingestion mechanism in XSOAR. Configuring the fetch query, the first fetch timestamp, and the incidents-per-fetch limit controls how many alerts are pulled per polling cycle, while the instance credentials authenticate to the source. This satisfies both the throughput limit and authentication requirement without custom polling code.

The Indicator Details view surfaces the indicator's current reputation and calculated score, letting analysts judge severity at a glance. This reputation value reflects aggregated threat intelligence verdicts, satisfying the stem's requirement for details visible within an individual indicator's record.

Line charts are natively supported when building custom dashboard widgets in Cortex XSOAR, letting engineers plot time-series trends such as incident volume or severity over a selected period. This makes Line one of the three correct widget types in the scenario.

The 'Assign to Incident Field' setting binds the task's collected response directly to a chosen incident field, so the user's answer persists on the incident record rather than only in task context. This satisfies the requirement to map the response to a specific incident field.

Account-based segregation with RBAC on the central server isolates incidents, playbooks and integrations per child tenant, satisfying the multi-tenant isolation requirement. Each account scopes its own content, while RBAC restricts users to their assigned tenant, preventing cross-tenant visibility or modification. This is the mechanism Cortex XSOAR uses for tenant separation.

Condition tasks evaluate a script or expression and route execution down a true or false branch, directly altering the playbook's path. This satisfies the stem's requirement for a task type controlling flow and execution path, unlike standard automation or data-collection tasks.

Dashboards are composed primarily of widgets displaying metrics and charts.

Outgoing indicator properties are governed by the STIX/TAXII server's mapping rules, which translate Cortex XSOAR fields into STIX objects. If custom fields are unmapped, recipients never receive them. Checking these outgoing mapping rules directly addresses the reported missing custom fields.

Deduplication rules in XSOAR compare incoming incident fields against existing incidents using a defined key and lookback window. Keying on a stable field like the resource identifier ensures that repeated alerts about the same resource are treated as duplicates, while the time window limits how far back the comparison looks so unrelated older incidents are not merged.

Cortex XSOAR executes sub-playbook tasks synchronously unless you explicitly enable the asynchronous flag, so the parent pauses at that task until the child finishes. This default satisfies the requirement to wait for full completion before continuing.

A conditional task evaluating reputation or confidence before the block command ensures only high-confidence indicators reach the firewall. Placing the filter there prevents low-confidence indicators from being blocked, satisfying the workflow's requirement that only high-confidence indicators trigger perimeter blocking.

The incident ID appears in the header by default, giving engineers a unique reference for correlating the incident across the console, API calls and audit logs. It satisfies the stem's requirement for default header content, unlike custom fields or playbook outputs, which must be added manually.

Settings > Import / Export > Import uploads a content bundle archive and merges its playbooks, scripts and layouts into the target tenant. This is the supported mechanism for promoting customised content between development and production instances without manual recreation.

Auto-extract indicator settings are defined per incident type, letting you control which indicator types Cortex XSOAR extracts from incident fields automatically. This satisfies the stem's requirement for associated configurations, alongside the other two correct options, by binding extraction behaviour directly to the custom incident type rather than globally.

The TAXII2 integration parses each STIX object's pattern and maps recognized types (for example ipv4-addr, domain-name, file hashes) to Cortex XSOAR indicator types. Pattern types it cannot map, like network-traffic, are silently dropped rather than raising an error, which matches the successful fetch with missing indicators. Engineers must pre-process or convert such objects before ingestion.

Toggling the integration instance's active status preserves all configured parameters, indicator reputation settings and field mappings while halting scheduled fetches, satisfying the requirement to silence the noisy feed temporarily without losing its configuration. Re-enabling later restores the same instance rather than requiring reconfiguration from scratch.

Because the SIEM accepts indicators over a REST API, the engineer can build a custom integration or automation script that formats and POSTs indicators to that endpoint, triggered on a schedule or by a playbook. This is a valid outbound mechanism when no dedicated pack exists. It correctly addresses the SIEM leg of the requirement by leveraging the platform's scripting and integration framework.

Cortex XSOAR supports PostgreSQL SSL connections. By enabling SSL on PostgreSQL and adding sslmode=require (or verify-full) to the connection string, all traffic between the application server and database is encrypted. This satisfies the security requirement without additional components and is the documented method for securing the database connection.

RBAC scopes user permissions and data visibility to assigned tenant accounts, preventing cross-tenant access in a shared deployment. Evaluating how roles map to tenants ensures analysts only view and act on their own tenant's incidents, satisfying multi-tenant isolation requirements.

Playbooks execute response actions automatically once a trigger fires, removing manual analyst steps from repetitive triage and containment. This directly reduces Mean Time to Respond, the metric named in the option, by cutting the human latency between alert detection and remediation action.

The Generic Feed integration, built on the GenericFeed module, parses arbitrary JSON structures by mapping custom indicator fields, so non-standard threat feeds can be ingested without a bespoke integration. It satisfies the stem's custom-structure requirement directly.

Signature validation compares the SAML assertion's signature against the IdP certificate stored in Cortex XSOAR. A mismatch between that imported certificate and the one currently configured on the Identity Provider causes validation to fail, producing this error.

Password-protected archives cannot be extracted without credentials, so the extraction task must receive password parameters or an analyst prompt supplying known container passwords. This satisfies the scenario's requirement by making the password available at extraction time rather than failing the task.

Enabling fetch indicators on the TAXII integration instance is the prerequisite for scheduled ingestion; without it, XSOAR never polls the collection, so no indicators reach the Threat Intel page regardless of server connectivity. This directly satisfies the stem's requirement to verify the ingestion pipeline first, before investigating parsing, reputation, or indicator-type mapping.

Conditional tasks let you rename each outgoing branch, so analysts see meaningful outcome labels rather than generic true/false paths. This satisfies the stem's requirement that custom branch labels for different outcomes are configurable within the task itself.

Cortex XSOAR uses HTTPS on port 443 to connect to update servers for content packs and system updates. Ensuring outbound access to these servers is essential for automatic updates. Without this connectivity, the server cannot retrieve the latest packs or patches, leaving it outdated and potentially vulnerable.

Layouts can be assigned to specific incident types, ensuring tailored fields and tabs appear for specific incident categories.

Scheduled report definitions in Cortex XSOAR include a schedule field expressed in cron syntax that governs when the report is generated and dispatched. Setting it to fire every Monday at 08:00 is exactly what produces the recurring weekly delivery. Recipient addresses and output format are separate fields, so only the schedule setting determines recurrence, making it the element that must be configured for the Monday cadence.

Incident fields render in the Incident Info panel only when included in the incident type's layout. Creating a field registers it in the schema but does not place it on any layout, so analysts see nothing until it is added to the assigned layout.

Cortex XSOAR engines establish a secure connection to the server using HTTPS. By default, they communicate over port 443, which is the standard secure web port. This encrypted channel ensures that commands and data are transmitted securely between the engine and the server.

The TAXII2 Server integration turns Cortex XSOAR into a TAXII 2.x server, allowing external consumers to pull indicators from collections you expose. This is a supported export mechanism because the partner's TAXII client can query the endpoint and retrieve indicators in STIX format. It directly satisfies the requirement to share indicators with an external partner's TAXII infrastructure without custom code, using the platform's built-in server capability.

A lookup dataset stores the mapping outside the playbook. The playbook task reads the dataset at runtime and dynamically selects the sub-playbook, so changing the mapping later only requires editing the dataset, not the playbook. This directly satisfies the requirement to alter routing without modifying playbook logic, and it is a supported XSOAR design pattern.

Batching limits the number of API and context operations per iteration, preventing excessive memory use and event-loop starvation. Using native demistomock/demisto execution patterns with bounded loops ensures the script yields control back to the XSOAR server, so the event loop is never blocked.

XSOAR Dashboards and Reports include built-in widget templates covering incident counts, automation rate and mean time to resolution, letting the team visualise quarterly metrics without custom development. This directly satisfies the requirement to track those specific success metrics.

A playbook attached to the Phishing incident type runs automatically when the incident is created. Adding a task that executes the addWarRoomEntry automation posts the runbook link into the War Room immediately, satisfying the requirement without analyst action. This is the standard pattern for seeding context into an incident's conversation at creation time.

The 'send-mail' command is the standard way to send emails in Cortex XSOAR. It allows you to specify recipients, subject, and body, and you can use context variables like ${incident.id} and ${incident.severity} in the arguments. This task type is appropriate for sending notifications and is commonly used in playbooks.

Layout sections can be configured to render expanded or collapsed by default. Marking the section expanded ensures the department, manager, and compliance tier fields are immediately visible when the Data Breach incident opens, without the analyst having to click to reveal them.

The 'Continue on error' setting on a task allows the playbook to proceed to the next task even if the current task fails. This is exactly what is needed to ensure that a failure in one task does not halt the entire playbook. It is a per-task configuration that provides resilience in automated workflows where some steps may fail but overall progress is desired.

Using a custom incident field to store the ticket ID is a reliable way to track ticket creation. Before creating a ticket, the playbook checks if the field has a value; if so, it skips creation. This prevents duplicates across multiple playbook runs and is a standard practice in XSOAR for idempotent operations.

Using separate tasks for each notification method ensures that each integration is used appropriately. The email task uses the 'send-mail' command, and the Slack task uses the 'slack-send-message' command. Both can include a link to the incident, providing clear and reliable notifications to the respective channels.

On RHEL, Cortex XSOAR runs as the demisto systemd unit, so systemctl restart demisto stops and starts the server service cleanly. Alternatives such as service commands or direct binary invocation bypass systemd's dependency and restart handling, and the unit name is demisto, not xsoar.

Cortex XSOAR server clustering natively requires PostgreSQL, which stores the shared configuration and tenant data that cluster nodes must access consistently. This satisfies the high-availability constraint, since the database tier must be reachable by every node rather than tied to one server.

The Indicators page under Threat Intel provides a New Indicator action, letting an analyst enter a single domain manually and commit it straight to the database. This is the most direct route for one known malicious domain.

The Incoming Mapper attached to the integration instance defines how raw fetched data maps to incident fields. Editing that mapper lets the administrator hard-code SourceChannel to 'Email' for every incident created by this instance, satisfying the automatic population requirement.

A Manual Task pauses the playbook and presents instructions, form fields and a decision prompt to the assigned analyst, so the human review step is explicit and auditable. Automated tasks would execute without waiting, breaking the required manual phishing assessment.

Mapper parameters within the integration instance configuration define how XSOAR incident fields translate to ServiceNow fields, satisfying the ticket-synchronisation mapping requirement. Mappers are bound at instance level, so each ServiceNow connection applies its own field translation during incident creation and updates.

In TAXII 2.1 and STIX feed integrations, the 'Fetch indicators' parameter must be enabled for retrieved objects to be parsed and written into the Threat Intel database. If it is disabled, manual fetch returns raw objects but no indicators are created, which exactly matches the reported symptom of a successful fetch with an empty Threat Intel page.