Automation and Orchestration
This domain tests whether you can chain tasks into reliable automation: task types, error handling, parallel execution, scheduled jobs, and indicator reputation, including where the platform's defaults will surprise you.
Task behaviour
- Automated tasks run a script or integration command; manual tasks wait for a human; data-collection tasks prompt for structured input; condition tasks branch on context.
- Quiet mode suppresses task output in the War Room, which keeps investigations readable but hides evidence you may need when debugging.
- Continue-on-error keeps a playbook alive past a failed task; without it the run stops at that task.
- Parallel branches are useful but risky when two branches write the same context key, because the last writer wins.
Indicators and reputation
- Reputation commands are invoked as
!ip,!domain,!filein the War Room; inside a playbook task you reference the command name without the exclamation mark. - Each integration contributes a DBotScore; the aggregated score drives severity escalation and indicator verdicts.
- Indicator extraction and threat-intel feeds populate the indicator store, and expiration rules stop stale indicators from driving decisions.
Worked example
Enrich an external IP and escalate if malicious. Reasoning: an automated task runs the reputation command, which fans out to every configured instance implementing it; a condition task checks the aggregated DBotScore; a high score routes to a manual containment task. If one provider times out, continue-on-error keeps the aggregated verdict intact.
Traps
Writing an exclamation mark in front of a command inside a playbook task, assuming a scheduled job runs as whoever created it, and letting a silent failure look like a clean run.