Palo_Alto_Networks
XSIAM-ANALYST · Question #36
For a critical incident, Cortex XSIAM suggests several playbooks which should have been executed automatically. Why were the playbooks not executed?
The correct answer is A. Playbook triggers were not configured for those alerts. XSIAM only auto-runs playbooks when a trigger (automation rule) is defined for the alert/incident criteria. Without that trigger, the system can suggest relevant playbooks but will not execute them
Automation and Playbooks
Question
For a critical incident, Cortex XSIAM suggests several playbooks which should have been executed automatically. Why were the playbooks not executed?
Options
- APlaybook triggers were not configured for those alerts.
- BInstallation of the appropriate content pack was not completed.
- CMisconfiguration of the connector instance has occurred.
- DPlaybook classifier was not configured for the alert type.
How the community answered
(52 responses)- A71% (37)
- B4% (2)
- C15% (8)
- D10% (5)
Explanation
XSIAM only auto-runs playbooks when a trigger (automation rule) is defined for the alert/incident criteria. Without that trigger, the system can suggest relevant playbooks but will not execute them
Topics
#Playbook Triggers#Automation Configuration#Alert Mapping#Incident Playbooks
Community Discussion
No community discussion yet for this question.