Palo Alto Networks Certified Security Automation Engineer (PCSAE)PlaybooksMedium
A security analyst is debugging a Cortex XSOAR playbook that is failing at a specific script task. The script is designed to parse a complex JSON output from a previous API call. The playbook context shows that the raw output from the API call is present, but the script task consistently reports a 'key not found' error when trying to access a specific field. What is the most likely cause of this issue?
- AThe script is using an incorrect context path to access the JSON data.
- BThe API call task is not waiting for its results before the script executes.
- CThe playbook is missing a 'Join' task before the script, causing race conditions.
- DThe script has a syntax error in its Python code.
Show answer & explanationAnswer & explanation
Correct answer: A. The script is using an incorrect context path to access the JSON data.
A 'key not found' error when parsing JSON, despite the raw output being present, strongly indicates that the script is attempting to access a field using an incorrect or non-existent context path, or the JSON structure itself is different than expected.
Why the other options are wrong
- B. If the raw output is present in context, the task has already waited for results.
- C. 'Join' tasks handle parallel branches; if the raw output is already in context, it's not a race condition issue related to task synchronization.
- D. A syntax error would typically prevent the script from running at all, or raise a different type of error, not specifically 'key not found' after parsing attempts.
Playbook Context Path Issues
Errors occurring when a script or task attempts to retrieve data from the playbook context using an incorrect, misspelled, case-sensitive, or non-existent path, often resulting in 'key not found' or 'none type' errors.
- Case sensitivity is crucial in context paths.
- Verify the exact structure of JSON/dictionary output.
- Use the 'Context' tab during debugging to inspect paths.
Memory trick: When the map is wrong, the key to the treasure is lost.