Playbooks typically handle which types of data?

Question

Options

• AContainer data, Artifact CEF data, Result data, List data
• BContainer data, Artifact data, Result data, Threat data
• CContainer data, Artifact CEF data, Result data, Threat data
• DContainer CEF data, Artifact data, Result data, List data

• A
  89% (34)
• B
  5% (2)
• C
  3% (1)
• D
  3% (1)

Explanation

Option A is correct because Splunk SOAR (and similar SOAR platforms) playbooks operate on four specific data types: Container data (the event/case wrapper), Artifact CEF data (individual data points stored in Common Event Format), Result data (outputs from executed actions), and List data (custom reference lists used for lookups and tracking).

Why the distractors fail:

• B replaces "Artifact CEF data" with plain "Artifact data" (missing the CEF qualifier) and swaps "List data" for "Threat data" - neither substitution matches the platform's actual data model.
• C correctly uses "Artifact CEF data" but replaces "List data" with "Threat data" - threat data is a category of content, not a distinct playbook data type.
• D misapplies CEF to Containers ("Container CEF data") when CEF is an artifact-level format, and uses plain "Artifact data" instead of "Artifact CEF data."

Memory tip: Think "C-A-R-L" - Container, Artifact CEF, Result, List. The key discriminator is that CEF belongs to Artifacts (not Containers), and Lists (not Threat data) complete the four-type set.

No community discussion yet for this question.