Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsMedium
A security operations team is observing that their Cortex XSOAR instance is experiencing performance degradation during peak incident processing times. The current architecture uses a single XSOAR server. The team needs to distribute the workload for long-running automations and integrations to prevent the main server from becoming a bottleneck. Which XSOAR component should they deploy to offload these tasks?
- ACortex XSOAR Engine
- BExternal Database
- CAdditional XSOAR Server in HA
- DDedicated Load Balancer
Show answer & explanationAnswer & explanation
Correct answer: A. Cortex XSOAR Engine
Cortex XSOAR Engines are designed to execute integrations and automations remotely, offloading these tasks from the main XSOAR server. This distributes the workload, improves performance, and allows the main server to focus on UI and core logic.
Why the other options are wrong
- B. An external database primarily improves database performance and scalability, but doesn't offload the execution of automations and integrations.
- C. An additional XSOAR server in HA provides redundancy and failover, but both servers would still be performing the same tasks, not specifically offloading long-running automations.
- D. A dedicated load balancer distributes incoming user requests to multiple XSOAR servers but does not offload the internal processing of automations and integrations.
Cortex XSOAR Engine
A lightweight, standalone component of Cortex XSOAR that executes integrations and automations remotely, separate from the main XSOAR server.
- Offloads workload from the main XSOAR server.
- Enables execution in isolated networks (DMZ, air-gapped).
- Improves performance and scalability of automations.
Memory trick: To scale performance, think of adding more 'Engines' to your XSOAR 'car' to run faster.