Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementEasy
A security operations center (SOC) manager wants to automate the initial data collection and enrichment for all new 'Phishing' incidents in Cortex XSOAR. Which component is primarily responsible for triggering these automated actions when a new incident is created or updated?
- AIncident Layouts
- BPlaybooks
- CDashboards
- DIncident Fields
Show answer & explanationAnswer & explanation
Correct answer: B. Playbooks
Playbooks are the core automation engine in Cortex XSOAR, designed to execute predefined tasks, collect data, and enrich incidents based on triggers. They are essential for automating incident response processes.
Why the other options are wrong
- A. Incident layouts define the visual presentation of an incident, not its automation logic.
- C. Dashboards provide visualizations and reports, not automation triggers.
- D. Incident fields store data but do not trigger automated actions.
Cortex XSOAR Playbooks
Playbooks in Cortex XSOAR are automated workflows that orchestrate security operations tasks, from data enrichment to containment and remediation.
- Automate repetitive tasks.
- Triggered by incident creation/updates or manual execution.
- Composed of tasks, conditions, and sub-playbooks.
Memory trick: Automated security actions are like a play, dictated by a script.