XSOAR-ENGINEER · Question #1
A breakpoint is added to a saved playbook to ensure that it pauses before running the task "ad- delete-user." However, it is later discovered that an Active Directory account was deleted by this…
The correct answer is A. The playbook does not stop at the breakpoint when run from an incident. Breakpoints in XSOAR are only effective when running the playbook in the playbook debugger. If the playbook is executed directly from an incident, it will not pause at the breakpoint, which is why the "ad-delete-user" task still ran and deleted the account.
Question
A breakpoint is added to a saved playbook to ensure that it pauses before running the task "ad- delete-user." However, it is later discovered that an Active Directory account was deleted by this playbook, and the playbook did not pause at the breakpoint. What is the cause of this issue?
Options
- AThe playbook does not stop at the breakpoint when run from an incident.
- BThe task was not set to "skip."
- CThe task was not configured to override input.
- DThe playbook was not set to "quiet mode."
How the community answered
(41 responses)- A95% (39)
- B2% (1)
- C2% (1)
Explanation
Breakpoints in XSOAR are only effective when running the playbook in the playbook debugger. If the playbook is executed directly from an incident, it will not pause at the breakpoint, which is why the "ad-delete-user" task still ran and deleted the account.
Topics
Community Discussion
No community discussion yet for this question.