Palo Alto Networks Certified Security Automation Engineer (PCSAE)PlaybooksMedium
A security orchestration engineer is developing a playbook to escalate critical incidents. They need to ensure that an incident is assigned to a specific Tier 2 analyst group ONLY if the incident severity is 'Critical' AND the incident type is 'Malware'. What is the most efficient way to implement this logic within a single playbook task?
- AUtilize a single condition task with a Demisto Query Language (DQL) expression combining both conditions.
- BUse two separate condition tasks, one for severity and one for type, leading to the assignment task.
- CCreate a sub-playbook for each condition and execute them sequentially.
- DImplement a Python script task to evaluate both conditions and then trigger the assignment.
Show answer & explanationAnswer & explanation
Correct answer: A. Utilize a single condition task with a Demisto Query Language (DQL) expression combining both conditions.
Using a single condition task with a DQL expression (`incident.severity == 'Critical' and incident.type == 'Malware'`) is the most efficient and direct method to combine multiple conditions for task execution in Cortex XSOAR.
Why the other options are wrong
- B. This is less efficient as it requires branching and merging multiple tasks, making the playbook more complex.
- C. Creating sub-playbooks for simple conditions is overkill and significantly increases playbook complexity and overhead.
- D. While possible, using a Python script adds unnecessary overhead and complexity for a simple 'AND' condition that DQL can handle natively.
DQL in Playbook Conditions
Demisto Query Language (DQL) can be used within a playbook condition task to evaluate complex logical expressions involving incident fields, context data, and more, determining the execution path.
- Enables combining multiple conditions (AND, OR, NOT).
- Accesses incident fields and context data directly.
- Provides a powerful and efficient way to control playbook flow.
Memory trick: DQL helps decide the right path for incidents.