Automation, Playbooks, and Integrations
The Automation, Playbooks, and Integrations domain covers the automation layer: playbooks, tasks, integrations, commands, context data, and how automation attaches to incidents. Expect questions on task types, inputs and outputs, credentials, and safe containment.
Core rules
- Cortex XSIAM automation is built on the Cortex XSOAR engine. Playbooks are workflows made of tasks: automation, conditional, manual approval, data collection, and sub-playbook.
- Integrations are configured as instances with credentials and connection settings. Commands from an instance read and write context; playbook inputs and outputs pass data between tasks.
- Use content packs for supported integrations and playbooks, then review and adapt them. Do not assume a pack matches your incident fields or instance names.
- Trigger playbooks by incident type, alert, or manual action. Keep containment actions behind approval when they affect production systems.
- Store secrets in credentials, not in scripts or playbook inputs. Respect API rate limits and timeouts.
Worked example
A phishing incident arrives. The playbook extracts URLs and file hashes, enriches them with a threat-intel integration, and checks verdicts. If malicious, it posts to the war room and requests analyst approval; after approval, it blocks the URL and isolates the endpoint through the endpoint integration. Reasoning: enrichment is automatic, but disruptive containment is gated, and each task writes named context for later steps.
Traps
Hardcoding API keys in automation scripts; using the wrong integration instance; ignoring task timeouts and retries; assuming a playbook ran because it was attached; not mapping outputs to incident fields; skipping approval for isolation or blocking.