Palo Alto Networks Certified Security Automation Engineer (PCSAE)Automation and OrchestrationMedium
A SOC manager wants to implement 'shift left' principles by enabling Tier 1 analysts to resolve common, well-defined security incidents autonomously. This requires providing them with pre-approved, interactive playbooks that guide them through investigation and remediation steps, often involving human intervention for approval or data input. Which XSOAR playbook feature is essential for embedding these interactive decision points and data collection steps within an automated workflow?
- AManual Tasks
- BConditional Tasks
- CTimers
- DSub-playbooks
Show answer & explanationAnswer & explanation
Correct answer: A. Manual Tasks
Manual Tasks in Cortex XSOAR playbooks are specifically designed to introduce human interaction points. They can prompt for input, require approval, or guide an analyst through steps that cannot be fully automated, making them essential for 'shift left' strategies involving guided human intervention.
Why the other options are wrong
- B. Conditional Tasks control the flow based on data, not for direct human input or approval in the workflow.
- C. Timers introduce delays, not interactive human decision points.
- D. Sub-playbooks modularize workflows but don't inherently introduce interactive human decision points.
Cortex XSOAR Manual Tasks
Playbook tasks that require human interaction, such as inputting data, making a decision, or providing approval, to progress the automated workflow.
- Introduces human decision points.
- Collects human input.
- Essential for 'shift left' automation where human approval is needed.
Memory trick: MANUAL tasks bring the human touch to automation.