Playbook Development practice questions

${Endpoints.OS(val == 'Windows')}

Why it fails: This syntax is invalid for filtering lists in XSOAR context.

${Endpoints | filter(OS == 'Windows')}

Why it fails: The 'filter' keyword is not a direct pipe operator in XSOAR context expressions.

${Endpoints.[?(OS == 'Windows')] }

Why it fails: This is not the standard transformer syntax in XSOAR.

In the playbook-level JSON file under the 'canvas' properties

Why it fails: While stored in JSON, manual editing of canvas properties is not the standard interface for configuring loop concurrency.

In the integration instance settings for the executed command

Why it fails: Integration instances handle execution parameters for commands, not playbook loop orchestration.

In the global server configuration (Server Settings -> Incidents)

Why it fails: Global server configurations affect the entire XSOAR instance, not specific loop task concurrency.

Enable 'Skip task if empty' in the Task Details

Why it fails: 'Skip task if empty' only applies when input arguments resolve to empty values, not when commands return errors.

Wrap the command in a try-except Python wrapper inside the playbook UI

Why it fails: Playbook tasks do not support inline Python try-except wrappers directly in the canvas configuration.

Add a Post-processing script that catches exceptions

Why it fails: Post-processing scripts do not catch execution errors in the same manner as the dedicated task error handling settings.

${incident.GetIncidentDetails.ID}

Why it fails: The 'incident.' prefix refers to incident fields, not task outputs.

${task.GetIncidentDetails.ID}

Why it fails: The 'task.' prefix is not part of the standard context referencing syntax for task outputs.

$GetIncidentDetails[ID]

Why it fails: Square bracket indexing for keys is not the standard notation in XSOAR playbook context paths.

Export the playbook as a zip file and import it into a dashboard widget

Why it fails: Importing playbooks into dashboards is not a valid testing workflow.

Delete the old playbook and publish the new one directly to production

Why it fails: Deleting and republishing without testing risks disrupting live workflows.

Enable 'Debug Mode' in server configurations and restart the service

Why it fails: Debug mode increases log verbosity; it is not a playbook testing mechanism.

Run a bash command via integration to purge the Redis database.

Why it fails: Purging Redis directly disrupts the entire XSOAR instance and is not a playbook task method.

Rename the playbook to force a context reset.

Why it fails: Renaming a playbook does not clear incident context data.

Delete the task and recreate the playbook canvas from scratch.

Why it fails: Recreating playbooks is unnecessary for clearing context data.

A dashed border around the task box

Why it fails: Dashed borders are not used to indicate start nodes.

A red exclamation mark badge

Why it fails: A red exclamation mark indicates a configuration error or missing required fields.

A padlock symbol in the corner

Why it fails: A padlock indicates that the item is locked or read-only.

Automatically convert all looped outputs into PDF incident reports

Why it fails: Loop tasks do not generate PDF reports.

Directly modify the core XSOAR database schema during each iteration

Why it fails: Database schemas cannot be modified by playbook loop tasks.

Increase the global server CPU allocation via the CLI.

Why it fails: Incorrect. CPU allocation does not resolve integration timeout thresholds.

Modify the incident type layout to hide slow tasks.

Why it fails: Incorrect. Layouts affect UI display, not task execution timeouts.

customFields.impactlevel

Why it fails: Omitting the 'incident' root will fail because the context path must start from the incident object. The condition engine does not automatically assume the incident context. Without the 'incident' prefix, the field will not be found, and the condition will evaluate incorrectly, causing the playbook to take the wrong branch.

incident.impactlevel.value

Why it fails: Appending '.value' is unnecessary and incorrect for a string field. Custom fields are accessed directly as 'incident.customFields.impactlevel'. Adding '.value' would attempt to access a property that does not exist, resulting in a null value and a failed condition evaluation. This would disrupt the playbook's routing logic.

incident.impactlevel

Why it fails: Using 'incident.impactlevel' is incorrect because the condition builder in playbook tasks requires the full context path to incident fields. The 'incident' prefix alone does not resolve; you must specify 'incident.customFields.impactlevel' for custom fields. This option would cause the condition to evaluate as null, leading to unexpected branching.

Use a script task to call the integration command directly via the REST API.

Why it fails: Calling the REST API directly bypasses the built-in integration instance selection and authentication handling. It would require managing credentials and endpoints manually, which is error-prone and not the intended use of the platform. While it could technically work, it is not the appropriate configuration for dynamically selecting an integration instance within a playbook task.

Create a separate playbook for each tenant and trigger them by incident type.

Why it fails: Separate playbooks per tenant would duplicate logic and still require a mechanism to choose the right playbook. Incident type triggers do not evaluate the source brand or tenant dynamically. This approach also fails to avoid hard-coding because each playbook would still reference a specific integration instance internally, defeating the goal of dynamic selection.

Leave the 'Using' field empty so XSOAR automatically picks the first available instance.

Why it fails: Leaving 'Using' empty does not guarantee selection of the correct tenant instance; XSOAR may choose any enabled instance, leading to unpredictable results. It also does not dynamically evaluate the source brand. This would cause commands to run against the wrong tenant, which is unacceptable in a multi-tenant scenario where isolation is required.

Use the syntax ${incident.customFields.reported_ip} in the argument value field.

Why it fails: While custom fields are stored under 'CustomFields' in the incident context, standard incident fields like 'reported_ip' are accessed directly via ${incident.reported_ip}. Using 'customFields' would be incorrect for standard fields and might lead to an empty value. The 'customFields' prefix is used for custom incident fields, not standard ones.

Use the syntax ${inputs.reported_ip} in the argument value field.

Why it fails: ${inputs.reported_ip} refers to a playbook input named 'reported_ip', which is defined at the playbook level, not an incident field. Incident fields are accessed via ${incident.field_name}. Using inputs would only work if the value was explicitly passed as a playbook input, which is not the case here.

Use the syntax ${reported_ip} directly in the argument value field.

Why it fails: Using ${reported_ip} without the 'incident.' prefix would attempt to resolve the variable from the playbook context or task inputs, not from the incident fields. This would likely result in an empty or incorrect value because the field is stored in the incident context, not as a standalone variable. The correct prefix is required to access incident fields.

Use a 'ForEach' task with the 'Built-in' loop type and set the 'max iterations' field to 500.

Why it fails: Setting max iterations to 500 only caps the total number of loop iterations; it does not create fixed-size chunks. The task would still process one item per iteration, so the integration would receive 500 separate calls, which is exactly what the scenario wants to avoid. This option addresses a limit, not batching behaviour.

Use a 'Data Collection' task with a grid field and map each indicator to a row, then process rows one by one.

Why it fails: Data Collection tasks are designed to request input from a human analyst, not to iterate over machine-generated lists. Using a grid field would require manual entry or complex mapping, and processing rows one by one still results in one integration call per row. This does not achieve batching and adds unnecessary human interaction.

Use a 'Conditional' task that checks the list length and then calls a sub-playbook recursively until the list is empty.

Why it fails: A Conditional task evaluates a condition and branches, but it does not iterate over a list by itself. Recursively calling a sub-playbook until the list is empty is an anti-pattern in Cortex XSOAR: it multiplies task instances, complicates debugging, and can hit recursion or execution limits. It also does not group items into fixed-size chunks.

Add a 'Data Collection' task in the sub-playbook to capture parent context values.

Why it fails: A Data Collection task is used to present a form to a user for manual input. It does not automatically capture parent context values. While you could manually enter data, it is not a mechanism for programmatically passing data from parent to sub-playbook. The required method is input argument mapping.

Enable the 'Share context' option in the sub-playbook settings to automatically merge all sub-playbook context into the parent.

Why it fails: Cortex XSOAR does not have a 'Share context' option that automatically merges all sub-playbook context into the parent. Context sharing is not automatic; you must explicitly map inputs and outputs. Enabling any such option would not work because it does not exist in the product.

Use the 'Set' task in the parent playbook to write values directly into the sub-playbook's context.

Why it fails: The 'Set' task writes to the current incident context, but it cannot directly write into a sub-playbook's isolated context. Sub-playbooks run in their own context scope, and data must be passed explicitly via input arguments. Using 'Set' in the parent would not make the values available inside the sub-playbook.

In the sub-playbook task, select 'Use current incident context' and clear 'Private'.

Why it fails: 'Use current incident context' is not a standard option for sub-playbook tasks. While there is a 'Private' setting that controls whether the sub-playbook runs in a separate context, clearing it does not automatically merge all keys; the sub-playbook's context is still isolated unless explicitly shared via outputs or context keys.

Set the sub-playbook's 'Outputs' to include the desired keys.

Why it fails: Configuring outputs in the sub-playbook defines which keys are returned to the parent, but this requires modifying the sub-playbook. The engineer wants to avoid modifying the sub-playbook. Additionally, outputs alone do not automatically merge all context; they specify specific keys to propagate.

Enable 'Share context' in the sub-playbook task settings.

Why it fails: The 'Share context' option does not exist in the sub-playbook task configuration. While there is a setting to determine how the sub-playbook's context is handled, it is not named 'Share context'. Enabling a non-existent option cannot achieve the desired context merging.

Configure the loop task to run in parallel mode and set a maximum error threshold of 1.

Why it fails: Parallel mode is for concurrent execution, not for sequential looping with error handling. There is no 'maximum error threshold' setting for loop tasks. Parallel mode would process all items simultaneously, which is not desired. This option misunderstands the loop task's capabilities and would not stop on the first failure.

Add a 'stop loop' task after the enrichment task that executes only when the enrichment task fails.

Why it fails: Cortex XSOAR does not have a 'stop loop' task type. Loop termination is controlled by the loop task's own settings, not by external tasks. Even if such a task existed, it would need to be triggered conditionally, adding complexity. This approach is not supported and would not achieve the desired behavior.

Use a condition task inside the loop that checks the enrichment task's status and breaks if it is not success.

Why it fails: Condition tasks cannot break out of a loop; they only branch to different paths. There is no 'break' functionality in a condition task. While you could route to an end task, that would terminate the entire playbook, not just the loop. This approach does not cleanly stop the loop and may leave subsequent tasks unexecuted.

${incident.severity} >= 3

Why it fails: While this expression would also evaluate to true for High and Critical, it would also be true for any severity greater than 4, which does not exist in the defined scale. However, the scale only goes up to 4, so it would work in practice. But the requirement explicitly states 'High' or 'Critical', and using a range might inadvertently include future severity levels if the scale changes. The explicit comparison is more precise and aligns exactly with the requirement.

${incident.severity} in (3,4)

Why it fails: The 'in' operator is not supported in XSOAR playbook conditional expressions. XSOAR uses a custom expression language that supports comparison operators like ==, !=, >, <, and logical operators like and, or. Using 'in' would result in a syntax error or unexpected behavior, and the condition would not evaluate correctly.

${incident.severity} == 'High' or ${incident.severity} == 'Critical'

Why it fails: This expression compares the severity to string values, but the severity field is stored as an integer. In XSOAR, the severity is represented numerically, so comparing to strings would always evaluate to false. This would cause the condition to never be met, and the playbook would not branch as intended.

MaliciousIPs && MaliciousIPs.length > 0

Why it fails: This expression uses JavaScript-like syntax that is not supported in the Cortex XSOAR condition editor. The playbook engine evaluates conditions using a specific expression language, not arbitrary JavaScript. While the intent is correct, this syntax will cause a parsing error or fail to evaluate, so the task may not run as intended.

MaliciousIPs && MaliciousIPs.size > 0

Why it fails: The .size property is not part of the XSOAR condition language. While some scripting environments use .size, the playbook condition editor expects specific functions or operators. Using an unsupported property will likely result in an evaluation error, and the task may never run even when the list contains IP addresses.

exists(MaliciousIPs) && MaliciousIPs != []

Why it fails: The exists() function checks whether a key is present, but comparing an array to [] with != is not reliable in the XSOAR condition engine because empty arrays may be represented differently. This expression can evaluate incorrectly when the list is empty or missing, causing the task to run or skip unexpectedly. It does not robustly test for a non-empty list.

Return a string that matches the name of a task in the playbook.

Why it fails: Returning a string that matches a task name does not automatically direct the playbook flow. The playbook engine does not interpret arbitrary return strings as next task indicators unless the task is configured to use conditional branching based on that output. Without explicit configuration, the playbook proceeds to the next task in sequence.

Return a dictionary with a key named 'next_task' containing the task ID.

Why it fails: There is no built-in 'next_task' key that the playbook engine automatically interprets. While returning a dictionary is common, the playbook does not automatically use a key named 'next_task' to jump to a specific task. The engineer would need to configure the task to use that output explicitly, such as with a conditional task.

Use the return_when or next_task parameter in the script's metadata.

Why it fails: Cortex XSOAR scripts do not have metadata parameters like 'return_when' or 'next_task' to control playbook flow. Scripts are executed as tasks, and their outputs are made available in context. Flow control is managed by the playbook's task configuration, not by script metadata.

Configure the task to retry three times and then fail the playbook.

Why it fails: Retries can help with transient errors, but after the retries are exhausted, the task still fails and the playbook halts unless 'Continue on error' is set. This configuration does not allow subsequent tasks to run, nor does it capture error details for later review in the required way. It addresses resilience but not graceful continuation.

Add a manual task that prompts the analyst to skip the failed task.

Why it fails: A manual task requires human intervention and does not automatically continue execution. It also does not capture the error details programmatically; the analyst would have to manually note them. This approach introduces delay and is not a configuration that achieves automatic continuation with error capture, as required.

Use a condition task after the failing task to check if the task succeeded.

Why it fails: A condition task can check task status, but without 'Continue on error' enabled, the playbook stops at the failed task and never reaches the condition. The condition alone does not prevent the playbook from halting. Therefore, this configuration does not achieve the requirement of continuing execution after a failure.