XSOAR Engineer flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

XSOAR server component

The application server hosts the UI, API, content engine, and playbook execution logic. It coordinates work with engines and stores state in the database, making it the central control point.

Message broker role

RabbitMQ carries task and job messages between the server and engine workers. If the broker is unavailable, playbook tasks queue and never execute even though the UI loads.

Distributed engine

An engine deployed in a remote or isolated network that connects back to the server to run integrations and scripts. It enables automation against systems not reachable from the main server.

Elasticsearch indexing

Elasticsearch or OpenSearch stores search indexes for incidents and investigations. When it is down, incident search and indexing fail while other UI functions may still work.

Database statefulness

PostgreSQL stores incidents, configuration, and content metadata. Unlike stateless engine workers, it must be backed up and sized for growth, and it is a single point of failure if not made highly available.

Content pack compatibility

Content packs installed from the Marketplace must match the server version. Incompatible packs can fail to install or cause playbooks and integrations to behave unexpectedly.

High availability topology

HA requires a load balancer in front of multiple app servers plus redundant database and broker. The default single-node deployment is not highly available.

Playbook task types

Tasks are typed as standard, condition, manual, or built-in. The type determines whether the task runs a command, branches on filters, or waits for human input.

Context path referencing

Outputs are referenced as ${TaskName.FieldName} or incident paths. The reference must exactly match the declared output name, or the value resolves empty without an error.

Conditional task filters

Condition tasks use AND/OR filter groups over context keys to choose a branch. A misconfigured filter silently routes execution down the wrong path, so test both branches.

Integration YAML definition

The definition file declares commands, arguments, and outputs, while Python code implements them. Undeclared outputs are not mapped into context and cannot be referenced downstream.

CommonServerPython helpers

Helper classes such as BaseClient and CommandResults standardize HTTP calls, error handling, and output formatting, reducing boilerplate and making integrations consistent and easier to debug.

Incident field machine name

Custom incident fields are referenced by machine name, not display label. Playbooks and layouts using the wrong name show empty values or fail to bind.

return_results and return_error

Scripts return data with return_results() and signal failures with return_error(). Using them correctly ensures outputs reach context and errors surface to the playbook.

Pack structure

A content pack bundles metadata, integrations, playbooks, scripts, and layouts. Versioning and testing packs in a non-production tenant prevents regressions during promotion.

Incident status lifecycle

Incidents move through statuses such as New, In Progress, Pending, and Closed. Status changes drive dashboards, SLA timers, and reporting accuracy.

Incident type mapping

Incident type selects the layout and playbook trigger. Creating an incident with the wrong type skips the intended automation and displays unrelated fields.

Deduplication and grouping

Grouping rules merge related alerts into one incident. Rules that are too broad merge unrelated alerts, while rules that are too narrow create duplicate noise.

Incoming fetch mapping

Fetch mapping translates raw alert fields into incident fields. Missing mappings leave fields empty and break downstream conditions and layout display.

Playbook triggers

Triggers can be automatic on incident creation or manual. Automatic triggers require the incident type to match the playbook's configured trigger conditions.

SLA timers

SLA timers track response and resolution time and can pause or resume based on conditions. They feed SLA reporting and breach alerts.

War Room audit trail

War Room entries capture analyst notes, task outputs, and evidence. They are searchable and form the case audit trail used in reviews and reporting.

Closing playbook

A closing playbook runs when an incident is closed. It enforces close reasons and required fields so reports and audits remain accurate.

Task failure branching

Each task has success and failure paths. Routing failures to error-handling branches prevents a failed command from silently halting the entire playbook.

Scheduled jobs

Jobs run scripts or integrations on a time-based schedule. They are used for enrichment, housekeeping, and recurring checks independent of incident events.

Indicator reputation scoring

Reputation commands score indicators such as IPs, domains, files, and URLs. Scores determine whether indicators are marked malicious or benign and drive containment decisions.

Iteration and loop tasks

Iteration tasks process lists of indicators or alerts. Bound the list and use condition-based exits to prevent infinite loops and runaway automation.

Idempotent automation

Automations may retry, so scripts should check whether an action such as a comment, ticket, or containment was already performed before repeating it.

External tool orchestration

Integration commands drive EDR, SIEM, and ticketing systems. Failures should be logged and surfaced to the analyst rather than silently swallowed.

Stuck task diagnosis

A task stuck in Waiting usually means no engine is available, the integration is disabled, or the command is timing out. Check engine registration and instance status first.

Command tester

The command tester runs an integration command directly with given arguments. It isolates whether a failure is configuration, connectivity, or playbook mapping.

Log correlation

Server, engine, and integration logs are separate. Correlate by timestamp and incident ID to trace a failure across components during troubleshooting.