I85PREP
⌘ K
Cisco CyberOps Professional study materials
Cisco CyberOps Professional study resources

Cisco CyberOps Professional: Security Automation and Orchestration

Cisco CyberOps Professional · Work through your exam, one topic at a time.

All guide sections

Security Automation and Orchestration

Security Automation and Orchestration tests SOAR concepts, API mechanics, and safe automation. The exam expects you to design playbooks that enrich, contain, and document without breaking production or leaking credentials.

Core concepts

  • SOAR functions: case management, playbook orchestration, automation, and threat intelligence management.
  • Playbook vs runbook: a playbook encodes decision logic and actions; a runbook is the documented human procedure.
  • Safety: human-in-the-loop approval for destructive actions, idempotency, rollback, and audit logging.

API mechanics

  • REST over HTTP with JSON payloads; verbs include GET, POST, PUT, PATCH, DELETE.
  • Status codes matter: 200/201 success, 400 bad request, 401/403 auth failures, 404 missing, 429 rate limited, 500 server error.
  • Authentication: API keys, OAuth tokens, basic auth. Store secrets in a vault, never in code.
  • Handle pagination, rate limits, retries with backoff, and timeouts.
  • Python commonly uses requests and json; webhooks push events into orchestration.

Cisco context

Cisco SecureX orchestration (evolving into Cisco XDR), Umbrella API, Secure Firewall Management Center API, Secure Endpoint API, ISE pxGrid, and Secure Malware Analytics/Threat Grid API are common integration points.

Worked example

An alert contains a file hash. The playbook queries the hash reputation, and if malicious, quarantines the endpoint through the Secure Endpoint API, posts a case note, and notifies the analyst. If the API returns 429, back off and retry; if it returns 403, stop and check token scope. Quarantine requires approval because it is disruptive.

Traps that cost marks

  • Hardcoding credentials or tokens in scripts.
  • Automating destructive actions without approval.
  • Ignoring pagination, rate limits, or non-200 responses.
  • Assuming HTTP 200 means the action succeeded semantically.
  • No rollback or audit trail for automated changes.

Key points

  • SOAR provides case management, orchestration, automation, and intelligence management.
  • Playbooks encode decision logic; runbooks document human procedure.
  • REST/JSON APIs use HTTP verbs and meaningful status codes.
  • Secrets belong in a vault, not in code.
  • Destructive automation needs human approval, rollback, and logging.