Palo Alto Networks Certified Security Automation Engineer (PCSAE)Automation and OrchestrationHard
A cybersecurity team is integrating Cortex XSOAR with their vulnerability scanner and patch management system. The goal is to automatically initiate patching for critical vulnerabilities identified on production web servers, but only after a change request (CR) has been approved in their IT Service Management (ITSM) system. If the CR is rejected, the workflow should notify the security team and close the vulnerability incident. Which type of Cortex XSOAR task is crucial for ensuring the CR status is checked and the workflow adapts accordingly?
- AManual Task with conditional polling
- BRemediation Task
- CReporting Task
- DData Enrichment Task
Show answer & explanationAnswer & explanation
Correct answer: A. Manual Task with conditional polling
A manual task with conditional polling is crucial here. It allows the playbook to pause and wait for an external action (CR approval/rejection in ITSM) and then, through polling, check the status of that action periodically until a specific condition (approved/rejected) is met, enabling the workflow to proceed down the appropriate branch.
Why the other options are wrong
- B. Remediation Task performs an action (like patching) but doesn't handle waiting for external approvals or conditional branching based on them.
- C. Reporting Task generates reports and does not control workflow execution based on external input.
- D. Data Enrichment Task adds context but doesn't pause for external approval or dictate flow based on it.
Manual Task with Conditional Polling
A Cortex XSOAR playbook task that pauses the automation, waits for an external human action (e.g., approval), and periodically checks a system for the status of that action before proceeding.
- Enables human-in-the-loop automation.
- Crucial for workflows requiring external approvals or decisions.
- Uses polling to monitor status changes in integrated systems (e.g., ITSM).
Memory trick: Manual task with polling: wait, check, then go!