Palo Alto Networks Certified Security Automation Engineer (PCSAE)PlaybooksEasy
A security analyst is designing a playbook in Cortex XSOAR to automate the initial triage of security incidents. The analyst wants to ensure that a specific set of tasks, such as enriching IP addresses and file hashes, is always executed regardless of the initial incident type (e.g., phishing, malware, unauthorized access). Which playbook structure element should be used to guarantee this consistent execution path?
- AA conditional task with a 'true' expression
- BA sequential series of tasks directly in the main playbook
- CA parallel branch with a 'join' condition
- DA sub-playbook without input conditions
Show answer & explanationAnswer & explanation
Correct answer: B. A sequential series of tasks directly in the main playbook
For tasks that must always execute regardless of conditions, placing them directly in a sequential series within the main playbook ensures their consistent execution without introducing unnecessary complexity.
Why the other options are wrong
- A. While a 'true' expression would always execute, it adds an unnecessary condition for a guaranteed path.
- C. Parallel branches are for concurrent execution, not for guaranteeing a specific sequential path regardless of initial type.
- D. A sub-playbook could contain these tasks, but using it 'without input conditions' doesn't explicitly guarantee execution for all incident types without being called unconditionally.
Sequential Playbook Tasks
Tasks arranged in a linear order within a playbook, where each task executes only after the preceding one has completed.
- Ensures predictable execution flow.
- Ideal for mandatory, non-conditional steps.
- Simplifies playbook logic for guaranteed processes.
Memory trick: To ensure a task always runs, put it on the straight path.