Palo Alto Networks Certified Security Automation Engineer (PCSAE)IntegrationsMedium
A security analyst is testing a new custom integration that is designed to create alerts in an external ticketing system. After executing a command, the analyst observes that incidents are created successfully, but the War Room entry for the command shows a generic 'Command executed successfully' message without any specific details from the ticketing system's response. The integration code correctly parses the external API's JSON response. What is the MOST likely reason for the lack of detailed output in the War Room?
- AThe `return_results()` function is not being called with a `readable_output` parameter.
- BThe external API is not returning any response body.
- CThe integration is missing the `return_error()` function.
- DThe `outputs_prefix` parameter in `return_results()` is incorrectly formatted.
Show answer & explanationAnswer & explanation
Correct answer: A. The `return_results()` function is not being called with a `readable_output` parameter.
For specific details from an external API's response to be displayed in the War Room, the `return_results()` function must be called with its `readable_output` parameter populated with the desired information. Without it, Cortex XSOAR defaults to a generic success message.
Why the other options are wrong
- B. The question states the code 'correctly parses the external API's JSON response,' implying a response body exists.
- C. `return_error()` is for failures, not for displaying successful command details.
- D. `outputs_prefix` affects context data, not the human-readable War Room entry directly.
War Room Readable Output
The human-readable text displayed in the Cortex XSOAR War Room after an integration command or script executes, provided via the `readable_output` parameter of `return_results()`.
- Essential for conveying command results to analysts.
- Can be formatted using Markdown.
- Defaults to generic success/failure if not explicitly set.
Memory trick: Readable output makes War Room clear, don't forget it.