Cortex XSOAR
Cortex XSOAR is the automation and orchestration domain: how incidents are ingested, classified and mapped, how playbooks execute, and how context data moves between tasks.
Core rules and concepts
- Everything is incident-centric. Integrations with fetch incidents create incidents; a classifier decides the incident type, a mapper populates fields, and pre-processing rules can drop or transform incoming records before either runs.
- Playbooks are task graphs: integration commands (the
!prefix in the War Room), scripts, conditional tasks, sub-playbooks, manual and data-collection tasks. - Context is the JSON store playbooks read and write; reference it as
${incident.field}or${Context.Key}. Wrong key paths are the most common playbook bug. - Indicators live in the threat-intelligence database with indicator types and reputation commands such as
!ipand!file. - Content arrives as Marketplace packs; scripts run in Docker images, and engines execute tasks in remote networks.
Worked example
A phishing report needs triage. Extract indicators, enrich them, branch on the verdict: malicious means block sender and URL, notify the user, close; suspicious means assign to Tier 2; benign means close with a note. Reasoning: enrichment must complete before the conditional, each command writes to context, and the conditional tests the context key the enrichment actually produced - not a hardcoded value. Destructive steps belong behind approval tasks.
Traps
- Swapping classifier and mapper roles in scenario questions.
- Writing a playbook before confirming the integration instance is enabled and tested.
- Hardcoding indicator values instead of passing context.
- Automating blocking or deletion without an approval gate or rollback path.