XSIAM Analyst cheat sheet

Playbook types: issue-triggered playbooks run on alerts/incidents; indicator playbooks run on indicators; built-in system playbooks cannot be deleted, only disabled or duplicated for editing.

Playbook task types include: manual task, conditional (else/default path), data collection, script, command, and timer/delay; each task's input must be mapped from parent context or a literal.

War Room is the per-incident execution console: run commands and playbooks manually there, and inspect task inputs/outputs for debugging failed automations.

Automation scripts run in a sandboxed Python environment; the demisto object exposes demisto.args(), demisto.executeCommand(), demisto.getFilePath(), demisto.results(), and demisto.incidents().

Playbook trigger logic: a trigger binds a playbook to a query and object type (e.g., alert), and pre-processing rules can modify fields before playbook evaluation.

Incident/alert field mapping: use the mapper to translate raw alert fields into incident fields; unmapped fields break playbook filters that reference them.

Job scheduling: Jobs run scripts or playbooks on a cron-like schedule (e.g., every 5 minutes) and are the mechanism for recurring enrichment or cleanup tasks.

Loop limits: playbook tasks have a maximum iteration count to prevent infinite loops; exceeding it fails the task and can be surfaced in the War Room.

Automation debugging rule: if a command returns an error, check the task's input mapping first, then the integration instance status, then the command's arguments.

XSIAM ingests three primary data classes: endpoint (Cortex XDR agent), network (firewall/proxy logs), and cloud/identity logs; detection depends on normalized XDM fields.

XQL query structure: dataset selection (e.g., xdr_data), pipe-separated stages (filter, fields, sort, limit), and time range specified in the query UI, not in the query body.

XDM normalization maps vendor fields into standard schema fields (e.g., actor_effective_username, action_local_ip); detections referencing XDM fields work across data sources.

BIOC (behavioral indicator of compromise) rules are custom detection logic written in XQL that generate alerts when their condition matches.

Analytics/Correlation rules combine multiple alerts or events over a time window to produce higher-confidence detections and reduce noise.

Alert severity and confidence are separate fields; severity reflects impact, confidence reflects detection certainty, and both can drive routing.

MITRE ATT&CK mapping: detections and alerts carry tactic/technique tags used for coverage gap analysis and reporting.

Detection tuning: exclusion rules and alert suppression reduce false positives; suppression must be scoped by field values to avoid hiding true positives.

Causality chain: XSIAM links alerts into a causal graph so analysts can see the sequence of events leading to an incident rather than isolated alerts.

Incident lifecycle states include new, under investigation, and closed; closing requires a resolution reason (e.g., true positive, false positive, duplicate).

Response actions on endpoints: isolate, quarantine file, terminate process, and run script - each requires the endpoint to have a live agent connection.

Isolation blocks network traffic except the management channel to the Cortex XSIAM/Cortex XDR tenant, allowing the analyst to keep controlling the host.

Indicator handling: indicators can be manually or automatically blocked (e.g., file hash, IP, domain); blocklists apply to endpoints and can be scoped by policy.

Incident war room actions are logged in an audit trail; each action records the user, timestamp, and target for post-incident review.

Playbook-driven response: a response playbook can auto-isolate an endpoint, block a hash, and assign the incident to an owner based on severity.

Remediation vs containment: containment limits spread (isolate host, block hash); remediation removes the artifact (quarantine file, delete registry key).

Resolution reasons must match the actual outcome; choosing false positive when an action was taken corrupts detection metrics and tuning data.

Role-based access: analyst roles determine who can execute destructive actions (e.g., isolate, quarantine) versus read-only investigation.