XSOAR Engineer study plan

Map the XSOAR deployment topology (server, engine, database, message broker, content repos) and explain how a playbook task flows from incident trigger to worker execution

Install a local XSOAR evaluation instance or lab tenant and configure an integration instance plus a fetch-enabled incident type

Identify where content packs, custom scripts, and integrations live on disk and in the UI, and distinguish system content from user-created content

Trace one built-in playbook end to end and list every integration command it invokes

Write three Python automation scripts using the demisto object model (args, results, return_results, return_error) and verify them with the built-in script unit-test harness

Build a custom integration skeleton with a command, argument schema, and output context path, then test it against a mock API

Configure integration instance parameters, credentials, and proxy settings correctly for both scripts and integrations

Explain how context data is structured and reference prior task outputs with correct context key syntax

Author a multi-branch playbook using conditional tasks, built-in filters, and transformers to normalize data between steps

Implement sub-playbooks and use them to reuse shared logic across at least two parent playbooks

Add manual approval tasks, task-level timeouts, and error-handling paths that route failures to a remediation branch

Use playbook inputs and outputs deliberately so parent and child playbooks exchange data without hardcoded values

Convert repeated analyst actions into automated tasks and justify each automation decision against false-positive risk

Implement enrichment playbooks that query at least two threat-intel sources and merge results into a single verdict

Configure playbook triggers, incident type linkage, and pre-processing rules so automation fires only on intended incidents

Add loop/collection handling and deduplication logic to avoid redundant API calls