Palo Alto Networks Certified Security Automation Engineer (PCSAE)Automation and OrchestrationMedium
A security analyst is investigating a critical alert indicating potential ransomware activity on an endpoint. The initial alert provided only the hostname and a suspicious file hash. The analyst needs to quickly perform the following actions: 1) Isolate the endpoint, 2) Query Active Directory for user details, 3) Check a threat intelligence platform for the file hash reputation, 4) Scan the endpoint for other malicious artifacts, and 5) Create a ticket in the ITSM system. Manually performing these steps is time-consuming and inconsistent. Which Cortex XSOAR feature is designed to automate this sequence of actions reliably?
- AIncident Layouts
- BIndicators of Compromise (IOC) Management
- CPlaybooks
- DDashboards and Widgets
Show answer & explanationAnswer & explanation
Correct answer: C. Playbooks
Playbooks in Cortex XSOAR are automated workflows that define a sequence of tasks, integrations, and conditional logic to execute specific incident response procedures consistently and efficiently, making them ideal for standardizing and automating the described actions.
Why the other options are wrong
- A. Incident Layouts define the visual presentation of incident data, not the automated actions.
- B. IOC Management focuses on processing and distributing threat indicators, not orchestrating incident response steps.
- D. Dashboards and Widgets provide visualization of data, not automation of response actions.
Cortex XSOAR Playbook
An automated, step-by-step workflow in Cortex XSOAR that orchestrates security operations tasks, integrations, and human analyst interactions to respond to incidents.
- Defines a consistent response process.
- Integrates with multiple security tools.
- Can include conditional logic and human approval steps.
Memory trick: Playbooks are your incident response recipe.