Palo Alto Networks Certified Security Automation Engineer (PCSAE)Automation and OrchestrationMedium
A security analyst is investigating a compromised user account. The initial alert indicates suspicious login activity from an unusual geographic location. The analyst needs to quickly block the suspicious IP address on the perimeter firewall, disable the user's account in Active Directory, and then send an email notification to the user's manager. This entire sequence must be initiated manually by the analyst after reviewing the initial alert. Which Cortex XSOAR feature allows the analyst to trigger this pre-defined sequence of actions with a single click from the incident details page?
- ACustom Incident Fields
- BScheduled Playbooks
- CQuick Actions
- DPre-Process Rules
Show answer & explanationAnswer & explanation
Correct answer: C. Quick Actions
Quick Actions in Cortex XSOAR allow analysts to execute pre-defined playbook tasks or sub-playbooks directly from the incident layout with a single click. This provides immediate, analyst-initiated automation for common response procedures.
Why the other options are wrong
- A. Custom Incident Fields are for storing incident data, not for triggering automation.
- B. Scheduled Playbooks run at pre-determined times, not manually on demand from an incident.
- D. Pre-Process Rules apply actions to incoming incidents before they are created, not for manual post-creation actions.
Cortex XSOAR Quick Actions
Configurable buttons or links on an incident layout that allow analysts to manually trigger specific playbook tasks or sub-playbooks with a single click.
- Provides immediate, on-demand automation.
- Streamlines analyst workflow for common tasks.
- Can pass incident context directly to the triggered automation.
Memory trick: Quick Actions: one click, instant response.