Cortex XSOAR
Cortex XSOAR is the security orchestration, automation, and response platform, with threat intelligence management built in. The exam tests incident ingestion, playbook mechanics, and how data moves through context.
Core objects
- Incident types define fields and layouts; classification and mapping decide which incident type a fetched event becomes and which fields are populated.
- Playbooks are task graphs. Task types include standard, conditional, manual, data collection, and sub-playbook.
- Integrations supply commands; automation scripts transform data.
- Context is the incident's JSON data store. Tasks read and write context keys, and sub-playbooks receive inputs and return outputs.
- Indicators are extracted by indicator types and enriched with reputation commands; TIM manages intelligence feeds.
- The War Room is where analysts run commands and see playbook entries.
Worked example
A phishing integration fetches an email, but the incident appears as Unclassified. Reasoning: the integration fetched the raw event; the classifier failed to match its rules against the subject or body, so no incident type was assigned. Fix the classifier or mapper, not the playbook. Confirm the mapper fills required fields such as reporter and attachment before retesting.
Traps
- Editing a playbook when the failure is classification or mapping at ingestion.
- Assuming every task executes; conditional and manual tasks can skip or pause.
- Writing a value to the wrong context path, so later tasks cannot read it.
- Mixing up incident fields with indicator fields.