PCSAE Exam Dumps - Palo Alto Networks Certified Security Automation Engineer

${Files.[2].Name}

${Files.Name.[2]}

${File.[1].Name}

${File.Name.[1]}

The playbook assigned to the incident type

The playbook assigned to the indicator type

The playbook assigned during pre-processing

The playbook assigned by the integration

!incidentSet description="Confirmed Phishing"

/incidentSet description=Confirmed Phishing

!setIncident description="Confirmed Phishing"

/setIncident description=Confirmed Phishing

The ’Fetches Incidents’ option may not have been enabled

There are no new events from the external service

The first fetch should be manually triggered to start the fetching process

It can take up to 1-hour before incidents are initially fetched

Lists

Jobs

Pre-processing rules

Exclusion List

Using a debug statement

Using the demisto.debug() function

Using a print statement

Using the demisto.results() function

Min, Max, Count, Average, Custom Transformers

Min, Max, Count, Average, Custom Group By

Count, Average, Sum, Min, Max

Count, Sum, Min, Max, Transformers

Using the demisto_error() function

Using a print statement

Using the demisto.debug() function

Using the return_error() function

Mark ignore output = true

Use extend-context

Use raw-response = save

Mark ignore input = true

Navigate to Settings

View the configured integrations and select Active Directory Authentication

Delete all integration instances and add all integration instances again

Navigate to Marketplace

View the installed content pack and select Active Directory content pack

Select version 1.4.6 and click on "Revert to this version"

Navigate to Settings

View the configured integrations and select Active Directory Query

Delete all integration instances and add all integration instances again

Navigate to Marketplace

View the installed content pack and select Active Directory content pack

Click on uninstall content pack

Navigate to Marketplace browser and reinstall the Active Directory content pack

Contains/Includes

Equals/Matches

In/In list

Is defined/Exist

Get DBotScore.value where DBotScore.Score (Larger or equals) 4

Get DBotScore.value where DBotScore.Score (equals (int)) 3

Get DBotScore where DBotScore.Score (Larger than) 1

Get DBotScore where DBotScore.Score (Larger or equals) 2

Define input key in the subplaybook task. Map context values to pull from parent playbook.

The output of the previous task automatically becomes the input of the subplaybook.

Map inputs and outputs to the parent playbook and the subplaybook will use the same values.

Open the subplaybook and add inputs or outputs in the Playbook triggered task.

Define a task in a playbook to generate an incident report before the closure occurs

Manually create an ‘Incident Report’

Configure post-processing using a script

Create an ‘Incident Report’ from the Reports page

F - Reliability cannot be judged, A - Completely Reliable

F - Not reliable, A - Usually Reliable

F - Not usually reliable, A - Fairly Reliable

F - Unreliable, A - Completely Reliable

Fields can be used in playbooks and labels cannot

Fields are indexed in the database and labels are not

Labels can be used in queries and fields cannot

Labels are indexed in the database and fields are not

Use a field trigger script

Use a field display script

Create a job that queries for incident severity changes

Change the SLA manually every time the severity changes

${incident.sourceip}

${incident.Source_IP}

${incident.srcip}

${incident.Source IP}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with no argument

Edit the incident layout to add a new button that calls the AssignToMeButton automation with argument assignBy={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument owner={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument assignBy=current

Standard (Manual)

Conditional

Section header

Standard (Automated)