Palo Alto Networks Certified Security Automation Engineer (PCSAE)PlaybooksEasy
A security orchestration engineer is developing a playbook to automate incident response. They have a sub-playbook that enriches indicator data, and another sub-playbook that performs containment actions. The enrichment sub-playbook needs to run first, and its output (enriched data) must be available for the containment sub-playbook. How should this be configured to ensure proper data flow and execution order?
- APlace the enrichment sub-playbook as a prerequisite task for the containment sub-playbook.
- BRun both sub-playbooks in parallel and use a Join task to combine their outputs.
- CUse a script to manually pass context data from the enrichment to the containment sub-playbook.
- DConnect the enrichment sub-playbook directly to the containment sub-playbook with a sequential arrow.
Show answer & explanationAnswer & explanation
Correct answer: D. Connect the enrichment sub-playbook directly to the containment sub-playbook with a sequential arrow.
Connecting sub-playbooks sequentially ensures that the first sub-playbook completes before the second begins, and its outputs are automatically written to the context, making them available for subsequent tasks.
Why the other options are wrong
- A. There is no 'prerequisite task' concept in XSOAR for sub-playbooks in this manner; sequential connection is the standard.
- B. Running in parallel would not guarantee the enrichment data is ready before containment starts.
- C. While possible, manually passing context via a script is unnecessary and less efficient than XSOAR's automatic context propagation for sequential tasks.
Sequential Playbook Execution
Tasks or sub-playbooks connected sequentially in a playbook execute in order, with outputs from preceding tasks automatically available to subsequent tasks via the context.
- Ensures defined execution order.
- Facilitates automatic context propagation.
- Default and most common connection type.
Memory trick: Order matters, like chapters in a story, data flows freely.