Build automated incident response playbooks in Cortex XSOAR (Demisto) using its YAML playbook structure, integration commands, and task types to orchestrate phishing, malware, account-compromise, and DDoS response workflows across SOC tools. Use when authoring or wiring up an XSOAR playbook, adding custom XSOAR integration commands or Python automation scripts, or reducing manual SOC response time via orchestration.
Build automated incident response playbooks in Cortex XSOAR (Demisto) using its YAML playbook structure, integration commands, and task types to orchestrate phishing, malware, account-compromise, and DDoS response workflows across SOC tools. Use when authoring or wiring up an XSOAR playbook, adding custom XSOAR integration commands or Python automation scripts, or reducing manual SOC response time via orchestration.
Cortex XSOAR (formerly Demisto) is Palo Alto Networks' Security Orchestration, Automation, and Response platform. Playbooks are the core automation engine in XSOAR, enabling SOC teams to automate repetitive incident response tasks. XSOAR provides 900+ prebuilt integration packs, 87 common playbooks, and a visual drag-and-drop editor for building custom workflows. Organizations using SOAR automation reduce mean time to respond (MTTR) by 80% on average.
When to Use
When deploying or configuring implementing soar playbook with palo alto xsoar capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Cortex XSOAR deployed (version 8.x or later, or XSOAR hosted)
Administrative access for playbook creation
Integration packs installed for relevant security tools
Incident types and layouts configured
API access to external tools (SIEM, EDR, TI platforms, ticketing)
Playbook Architecture
XSOAR Component Hierarchy
Incident Type (e.g., Phishing)
|
v
Incident Layout (UI display configuration)
|
v
Pre-Processing Rules (auto-classification, deduplication)
|
v
Playbook (automation logic)
|-- Sub-Playbooks (modular reusable workflows)
|-- Tasks (individual automation steps)
|-- Conditional Tasks (decision branches)
|-- Scripts (custom Python/JavaScript)
|-- Integrations (external tool commands)
|
v
War Room (investigation timeline)
|
v
Closing Report
id:phishing-investigation-fullversion:-1name:PhishingInvestigation-Fulldescription:Automatedphishingemailinvestigationwithenrichment,analysis,andresponsestarttaskid:"0"tasks:"0":id:"0"taskid:starttype:startnexttasks:'#none#':-"1""1":id:"1"taskid:extract-indicatorstype:regulartask:name:ExtractIndicatorsfromEmailscript:ParseEmailFilesnexttasks:'#none#':-"2"-"3"-"4""2":id:"2"taskid:enrich-urlstype:playbooktask:name:URLEnrichmentplaybookName:URLEnrichment-Genericv2"3":id:"3"taskid:enrich-filestype:playbooktask:name:FileEnrichmentplaybookName:FileEnrichment-Genericv2"4":id:"4"taskid:enrich-ipstype:playbooktask:name:IPEnrichmentplaybookName:IPEnrichment-Genericv2"5":id:"5"taskid:determine-verdicttype:conditiontask:name:IsEmailMalicious?conditions:-label:"yes"condition:--operator:isEqualStringleft:DBotScore.Scoreright:"3"-label:"no"nexttasks:"yes":-"6""no":-"9""6":id:"6"taskid:block-sendertype:regulartask:name:BlockSenderDomainscript:'|||o365-mail-block-sender'scriptarguments:sender_address:${incident.emailfrom}"7":id:"7"taskid:search-mailboxestype:regulartask:name:SearchandDeletefromAllMailboxesscript:'|||o365-mail-purge-compliance-search'scriptarguments:query:"from:${incident.emailfrom} subject:${incident.emailsubject}""8":id:"8"taskid:notify-usertype:regulartask:name:NotifyReportingUserscript:'|||send-mail'scriptarguments:to:${incident.reporter}subject:"Phishing Report Confirmed - Action Taken"body:"The email you reported has been confirmed as malicious and removed.""9":id:"9"taskid:close-incidenttype:regulartask:name:CloseIncidentscript:closeInvestigation
Trigger: Malware alert from EDR
Steps:
1. Extract file hash, process details, host info
2. Enrich hash via VirusTotal, Hybrid Analysis
3. Check if file is on allowlist
4. If malicious:
a. Isolate endpoint via EDR
b. Block hash on all endpoints
c. Search for hash across environment
d. Create incident ticket
5. If clean: Close as false positive
2. Account Compromise Playbook
Trigger: Impossible travel or suspicious login alert
Steps:
1. Get user details from Active Directory
2. Get login history for past 30 days
3. Check for impossible travel (geo-distance vs time)
4. Check for known VPN/proxy IP
5. If compromised:
a. Disable AD account
b. Revoke all OAuth tokens
c. Reset MFA
d. Notify user's manager
e. Search for lateral movement
6. If false positive: Document and close
3. DDoS Mitigation Playbook
Trigger: Network anomaly alert
Steps:
1. Verify traffic spike from network monitoring
2. Identify source IPs and geolocation
3. Check if source IPs are known botnets
4. Implement rate limiting on WAF
5. If sustained attack:
a. Enable upstream DDoS protection
b. Activate CDN scrubbing
c. Notify ISP if needed
6. Monitor and document
