Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsMedium
A security team has deployed Cortex XSOAR and is experiencing intermittent issues where automated tasks, particularly those involving network scanning and endpoint isolation, fail to execute or complete with errors. Upon investigation, it is found that these tasks often exceed network timeouts or are blocked by local firewalls. Which architectural component would best address these execution issues by placing it closer to the protected assets?
- AAdditional XSOAR Servers
- BXSOAR Engines
- CDedicated Database Server
- DContent Packs
Show answer & explanationAnswer & explanation
Correct answer: B. XSOAR Engines
XSOAR Engines are designed to be deployed in remote or internal network segments, closer to the assets they need to interact with. This allows tasks like network scanning and endpoint isolation to execute locally, bypassing network timeouts and firewall issues that might affect communication from a distant main XSOAR server.
Why the other options are wrong
- A. Adding more XSOAR servers (without Engines) would not resolve network connectivity or latency issues to internal assets.
- C. A dedicated database server improves database performance but does not solve issues with external network communication or local execution of tasks.
- D. Content Packs provide playbooks and integrations but do not address the physical network connectivity or execution location challenges.
XSOAR Engine for Local Execution
XSOAR Engines enable the platform to execute automated tasks and integrations directly within local or isolated network segments, overcoming network barriers like firewalls and latency.
- Reduces network latency for commands and data retrieval.
- Allows interaction with systems not directly exposed to the internet.
- Essential for on-premises security tools and endpoint actions.
Memory trick: Engines are local messengers for XSOAR, bringing commands right to your doorstep.