Palo Alto Networks Certified Security Automation Engineer (PCSAE)PlaybooksMedium
A security analyst needs to create a playbook that dynamically adapts its behavior based on the incident type. For 'phishing' incidents, it should run an email analysis sub-playbook, while for 'malware' incidents, it should run a file analysis sub-playbook. How should the main playbook be structured to achieve this dynamic behavior?
- ACreate two separate main playbooks, one for each incident type.
- BEmploy a condition task to evaluate the incident type and transition to the appropriate sub-playbook.
- CUse a single script task with if/else logic to call different sub-playbooks.
- DEmbed both sub-playbooks sequentially and use a 'Stop Playbook' task for the irrelevant one.
Show answer & explanationAnswer & explanation
Correct answer: B. Employ a condition task to evaluate the incident type and transition to the appropriate sub-playbook.
A condition task is the standard and most efficient way to implement branching logic in Cortex XSOAR playbooks. It evaluates the incident type from context and directs the playbook flow to the appropriate sub-playbook.
Why the other options are wrong
- A. Creating separate main playbooks duplicates common logic and makes overall management harder.
- C. While possible, using a condition task is a more visual, maintainable, and idiomatic XSOAR way to achieve this branching logic.
- D. Running both sub-playbooks and then stopping one is inefficient and wastes resources by executing unnecessary logic.
Conditional Sub-Playbook Execution
Conditional sub-playbook execution involves using a playbook condition task to evaluate specific criteria (e.g., incident type, indicator reputation) and then dynamically calling a particular sub-playbook based on the evaluation result.
- Enables dynamic and adaptive playbooks.
- Reduces complexity by calling only relevant logic.
- Utilizes playbook conditions for decision points.
Memory trick: Conditions Choose Correct Child Playbooks.