Palo Alto Networks Certified Security Automation Engineer (PCSAE)IntegrationsEasy
A cybersecurity firm is developing a custom integration for Cortex XSOAR. The integration needs to securely store sensitive configuration data (e.g., client IDs, tenant IDs) that are not API keys or credentials, but still require protection from unauthorized viewing. Which of the following methods is the MOST appropriate for storing such data within the integration's configuration parameters?
- AStore them in a global variable accessible to all XSOAR users.
- BUse a secure integration parameter type, such as 'Encrypted Text', even if not a password.
- CEmbed them directly into the Python code of the custom integration.
- DStore them as plain text integration parameters, as they are not 'credentials'.
Show answer & explanationAnswer & explanation
Correct answer: B. Use a secure integration parameter type, such as 'Encrypted Text', even if not a password.
Cortex XSOAR provides 'Encrypted Text' parameter types for integration configurations. This allows for secure storage of any sensitive string data, not just passwords or API keys, preventing unauthorized viewing while maintaining ease of management.
Why the other options are wrong
- A. Global variables are generally not secure for sensitive data, especially if accessible to 'all XSOAR users' without fine-grained control.
- C. Embedding sensitive data in code creates maintenance overhead, makes rotation difficult, and exposes the data to anyone with code access.
- D. Storing any sensitive configuration in plain text is a security risk, even if not considered a 'credential' in the strictest sense.
Secure Configuration Parameters
Integration parameters in Cortex XSOAR designed to securely store sensitive, non-credential data (e.g., client IDs, URLs, tokens) that should not be exposed in plain text.
- Uses 'Encrypted Text' type in integration configuration.
- Protects data from unauthorized viewing.
- Distinguishes from 'API Key' or 'Password' types for specific credential handling.
Memory trick: Parameters need protection, encrypt all sensitive data.