Cortex XSOAR � SOAR & Automation

// What is XSOAR?

Cortex XSOAR (Security Orchestration, Automation, and Response) is Palo Alto Networks' SOAR platform. It connects your security tools, automates repetitive analyst tasks, and orchestrates incident response workflows through a visual playbook engine.

In a mature SOC, XSOAR sits between the SIEM (which generates alerts) and the analyst (who investigates). It handles the initial enrichment � querying threat intel, looking up IPs, checking hashes against VirusTotal � automatically, so analysts spend time on decisions rather than data gathering.

// SOAR Concepts

// Console Overview

// Incident Management

Incidents in XSOAR are created automatically (via integrations pulling from a SIEM or EDR) or manually. Each incident has a type � Phishing, Malware, Network Attack, etc. � which determines which playbook runs automatically.

Key incident fields

// Playbooks

Playbooks are the core of XSOAR. They are visual flowcharts that define an automated response workflow � each step either runs a command, calls a sub-playbook, asks a human for input, or makes a conditional decision based on data in context.

Task types

Example: Phishing playbook flow

Trigger: New incident type = Phishing
? Extract IOCs from email (URLs, sender IP, attachments)
? Enrich sender IP (VirusTotal, AbuseIPDB)
? Check URLs against proxy / URL scanner
? Hash attachment ? check against VirusTotal
? [Conditional] If any IOC is malicious:
    ? Notify SOC lead via Slack
    ? Block sender domain in email gateway
    ? Search mailboxes for similar emails (O365 integration)
    ? [Manual] Analyst reviews and approves remediation
    ? Delete emails from all affected mailboxes
    ? Close incident
? [Else] Mark as false positive ? close

// War Room

The War Room is the investigation workspace for each incident. Every automated action, analyst command, file attachment, and note is logged here chronologically � creating a full audit trail of the investigation.

Running commands in the War Room

You can run integration commands directly from the War Room using the command input bar. Commands follow the pattern !integration-command argument=value.

!ip ip=1.2.3.4
!url url=http://evil.example.com
!file file=d41d8cd98f00b204e9800998ecf8427e
!whois query=evil.example.com
!ad-get-user username=jsmith
!cortex-xdr-isolate-endpoint endpoint_id=abc123

// Context Data

Context is XSOAR's data store for an incident � a structured JSON object that accumulates information as the playbook runs. Commands write their output into context paths, and playbook conditions read from those paths.

${IP.Address}                        � IP address of the indicator
${IP.Malicious.Vendor}              � Which vendor flagged it as malicious
${File.MD5}                         � File hash
${URL.Data}                         � The URL string
${Account.Username}                 � Username from AD lookup
${Endpoint.Hostname}                � Hostname from EDR query
${DBotScore.Score}                  � Normalised reputation score (0-3)

The DBotScore is a standardised reputation format: 0 = Unknown, 1 = Good, 2 = Suspicious, 3 = Bad. Most threat intel integrations populate this automatically so playbook conditions can branch on it without knowing the specific vendor format.

// Integrations

XSOAR's value comes from its integrations � connectors to external tools. The Marketplace has hundreds of pre-built integrations. Key categories:

// Automation Scripts

XSOAR scripts are Python (or JavaScript) functions that run in the platform sandbox. They can manipulate context data, call integration commands, and perform logic that can't be expressed with built-in tasks.

import re

def main():
    text = demisto.args().get('text', '')
    urls = re.findall(r'https?://[^\s\'"<>]+', text)
    unique_urls = list(set(urls))

    return_results({
        'Type': entryTypes['note'],
        'ContentsFormat': formats['json'],
        'Contents': unique_urls,
        'HumanReadable': f'Found {len(unique_urls)} URLs',
        'EntryContext': {'ExtractedURLs': unique_urls}
    })

main()

// Tips & Best Practices