Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementMedium
A global organization uses Cortex XSOAR to manage security incidents across multiple regional SOCs. They want to ensure that 'Critical' incidents (severity 4) are automatically escalated to a specific 'Regional Lead' user group based on the 'Region' incident field (e.g., 'EMEA', 'AMER', 'APAC'). Which XSOAR feature is primarily used for defining and enforcing this type of conditional assignment and escalation logic?
- AWar Room scripts
- BPlaybooks
- CDashboards
- DIncident Correlation rules
Show answer & explanationAnswer & explanation
Correct answer: B. Playbooks
Cortex XSOAR Playbooks are designed to automate incident response processes, including conditional logic for assignment, escalation, and other actions based on incident fields like severity and region. They are the core engine for such dynamic workflows.
Why the other options are wrong
- A. War Room scripts are ad-hoc commands run in the War Room, not for defining continuous, conditional automation logic across incident types.
- C. Dashboards are for visualization and reporting, not for automating incident handling logic.
- D. Incident Correlation rules are for grouping similar incidents, not for conditional assignment or escalation.
Cortex XSOAR Playbooks
Cortex XSOAR Playbooks are automated or semi-automated workflows that guide and execute incident response steps. They use conditional logic, tasks, and integrations to orchestrate actions based on incident data.
- Contain tasks (manual or automated).
- Utilize conditional logic for branching.
- Integrate with various security tools.
- Essential for standardizing and scaling incident response.
Memory trick: Playbooks Plan and Perform Processes.