XSIAM-ENGINEER: Palo Alto Networks Certified XSIAM Engineer

Azure Monitor action groups natively support email and SMS notifications. Slack and PagerDuty are external services that require an integration workflow, such as a webhook or Logic App/playbook.

For an automated task paused at a breakpoint, Cortex XSIAM allows the task to be run immediately or completed manually; manual completion requires marking the task completed before execution proceeds. Skipping the breakpoint task also bypasses that task and allows the playbook to proceed. Parallel tasks already in progress may continue, but they do not automatically resume the paused breakpoint task.

integrationContext is a cached, per-integration-instance key-value object. get_integration_context() retrieves the stored context, while set_integration_context() saves it; it is the setter, not the getter, that replaces the stored object. The stored keys and values must be strings.

When two incidents are merged in Cortex XSIAM, data and custom field values from the source (secondary) incident are not always automatically carried over to the destination (primary) incident, which is why an analyst can report missing details afterward. The reliable way to recover that information is to unmerge the incidents, which restores the original incidents together with their individual fields and context so the missing details can be retrieved and copied into the incident notes. Checking the destination War Room (A) or a child incident (D) will not surface fields that failed to transfer, and simply examining the source context (B) is not the prescribed remediation to restore the merged data.

Scope-Based Access Control (SBAC) scopes endpoint access through endpoint groups and tags. In Permissive Mode, access is allowed when a user has at least one scope tag that matches the relevant entity. Assigning the EG:Building3 scope therefore allows access to every endpoint in Building3, including endpoints that also have other endpoint-group memberships, while endpoints without the Building3 group remain outside the administrators’ scope.