Palo Alto Networks Certified Security Automation Engineer (PCSAE)PlaybooksMedium
A security orchestration engineer is designing a new playbook in Cortex XSOAR. They want to ensure that a specific task, which involves querying an external threat intelligence platform, only executes if the incident type is 'Malware' AND the incident severity is 'Critical'. Which playbook feature is most appropriate for implementing this logic directly on the task?
- AA manual task requiring analyst approval for execution.
- BA task pre-condition configured with a DQL query.
- CA sub-playbook with an entry condition that checks incident details.
- DA 'For Each' loop with an 'If' condition inside the loop.
Show answer & explanationAnswer & explanation
Correct answer: B. A task pre-condition configured with a DQL query.
Task pre-conditions allow for defining criteria that must be met before a specific task executes. Using a DQL query within a pre-condition is the most direct and efficient way to check multiple incident properties like type and severity for a single task.
Why the other options are wrong
- A. A manual task requires human intervention, which is not what's described as 'only executes if' based on incident properties. This would pause automation, not conditionally execute based on data.
- C. While a sub-playbook could have an entry condition, applying this logic directly to a single task within the main playbook is more efficient and simplifies the playbook structure, making a task pre-condition more suitable.
- D. A 'For Each' loop is used for iterating over lists, which is not the primary requirement here. While an 'If' condition could be used, it's less direct than a task pre-condition for a single task's execution logic.
Task Pre-condition
A condition defined on a specific playbook task that must evaluate to true before the task is allowed to execute.
- Controls individual task execution.
- Can use DQL for complex logic.
- Prevents unnecessary task execution.
Memory trick: Tasks only run if the 'pre-check' light is green.