implementing-soar-playbook-with-palo-alto-xsoar

Define a phishing incident type mapped to a playbook, then chain tasks: parse the email with ParseEmailFiles, run URL/File/IP enrichment sub-playbooks, branch on DBotScore verdict, and execute containment like o365-mail-block-sender. Gate destructive actions behind a manual analyst approval task.

XSOAR playbooks support standard tasks that execute commands, conditional tasks for branching logic, manual tasks requiring analyst input, section headers for organization, data collection tasks, and timer tasks that wait for a condition or time.

The incident type's playbook field may be unset, or a pre-processing or classification rule drops the event before assignment. Check the War Room for a playbook entry and verify Settings > Incident Types maps to the correct playbook.

This usually happens when DBotScore.Score is compared as a string while the context holds an integer, or enrichment output landed under a different context path. Inspect the context data and use isEqualString versus numeric operators consistently.

Use the demisto API to read incident and context data, compute your logic, and return results with CommandResults including outputs_prefix and readable_output. The example risk-scoring script combines severity, indicator counts, and malicious verdicts into a 0-100 score.

You need Cortex XSOAR 8.x or later deployed, administrative access for playbook creation, integration packs installed for your security tools, configured incident types and layouts, and API access to external tools like SIEM, EDR, and ticketing platforms.