Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsMedium
A security analyst is troubleshooting a playbook that intermittently fails when attempting to execute a command against a critical, air-gapped network segment. The XSOAR server is located in the main data center, which has no direct network path to the air-gapped segment. The playbook is configured to use an engine. Upon investigation, it is found that the engine is frequently disconnecting and reconnecting to the XSOAR server. What is the MOST likely cause of this intermittent failure and disconnection?
- AThe XSOAR server's database is experiencing high latency.
- BThe playbook logic has an error causing the engine to crash.
- CNetwork connectivity issues between the engine and the XSOAR server.
- DThe XSOAR license does not support air-gapped networks.
Show answer & explanationAnswer & explanation
Correct answer: C. Network connectivity issues between the engine and the XSOAR server.
Intermittent disconnections and reconnections of an XSOAR Engine to the main server are almost always indicative of unstable or unreliable network connectivity between the two components. Engines require a persistent, stable connection to function correctly.
Why the other options are wrong
- A. High database latency would affect the XSOAR server's overall performance, not specifically cause engine disconnections.
- B. Playbook logic errors typically result in playbook failure, not engine disconnection/reconnection.
- D. XSOAR licensing supports engines in air-gapped networks; this is a functional issue, not a licensing one.
XSOAR Engine Connectivity
XSOAR Engines maintain a persistent, outbound connection to the XSOAR server to receive commands and send back results.
- Outbound connection from engine to server
- Requires stable network path
- Disconnections indicate network issues
Memory trick: If the Engine stops, check the 'Cable' first!