Playbooks,
Python,
and the wire between them.

The platformorigin

Cortex XSOAR is Palo Alto Networks' Security Orchestration, Automation, and Response (SOAR) platform. It began as Demisto, acquired in 2019. The product name expands to eXtended Security Orchestration, Automation, and Response (XSOAR). It combines orchestration, automation, case management, and Threat Intelligence Management (TIM) in one platform.

Say the long form once in an interview and you sound like someone who knows what the letters mean, not someone repeating a product name.

Building blocks — know every one of these by name

Task types

• Standard — runs an automation or an integration command.
• Conditional — branches on context values, or runs a script returning a yes or no path.
• Manual — an analyst action; can block the playbook until completed.
• Data collection — sends a survey or form by email or Slack and waits for the response; answers land in context. This is how you gate containment on human approval.
• Sub-playbook — a nested playbook with its own isolated context unless inputs and outputs are passed explicitly.
• Section header — organization only, no execution.

Script anatomy

• Every script imports demistomock as demisto and from CommonServerPython import *.
• demisto.args() — a dictionary of the task's arguments.
• demisto.context() and demisto.incident() — read context and incident fields.
• demisto.executeCommand("cmd", args) — call another command from inside a script.
• return_results(CommandResults(...)) — the modern return path.
• return_error("msg") — fail the task with an error.

# CommandResults — the four arguments that matter
return_results(CommandResults(
    outputs_prefix='VirusTotal.IP',   # where it lands in context
    outputs_key_field='id',           # dedup key on repeat runs
    outputs=data,                     # the structured dictionary
    readable_output=tableToMarkdown('Result', data),  # War Room view
    raw_response=raw                  # untouched API response
))

DBotScore — short for Demisto Bot Score — is the standard context object for reputation: Indicator, Type, Vendor, Score (0 to 3). Writing DBotScore is how an integration feeds platform-wide indicator scoring, and it is what makes verdicts vendor-agnostic.

Integration anatomy — the BaseClient pattern

class Client(BaseClient):          # BaseClient from CommonServerPython
    def get_alert(self, alert_id):
        return self._http_request('GET', f'/alerts/{alert_id}')

def main():
    command = demisto.command()      # dispatch on the command name
    if command == 'test-module':      # the "Test" button
        return_results('ok')
    elif command == 'fetch-incidents':
        last = demisto.getLastRun()  # dedup + pagination state
        ...
        demisto.setLastRun({'time': newest})

• BaseClient handles the base Uniform Resource Locator (URL), certificate verification and proxy flags, retries, and authentication headers.
• test-module backs the Test button — return 'ok' on success.
• fetch-incidents pulls new alerts on a schedule, roughly every minute by default, and must manage last-run state with getLastRun and setLastRun for deduplication and pagination.

Development workflow — the job description's "automation best practices"

• demisto-sdk — the official software development kit (SDK) command line tool: init, validate, lint, format, upload, download, run. It lints with flake8, mypy, and bandit, and runs unit tests inside Docker.
• Content as code: custom content lives in Git as packs in the standard directory structure. Continuous Integration and Continuous Delivery (CI/CD) — GitHub Actions or Jenkins — runs validate, lint, and pytest, then uploads to a development instance and promotes to production. This is SOAR as code, the same discipline as detection as code.
• Remote repositories — XSOAR can synchronize content directly from a Git repository for development-to-production promotion.
• Unit testing: pytest with demistomock, mocking client._http_request, with fixtures stored as JSON files in test_data/.
• Packs are semantically versioned in pack_metadata.json.

What the letters mean

Representational State Transfer (REST) is an architectural style for web services: resources addressed by URL, acted on with HyperText Transfer Protocol (HTTP) verbs — GET to read, POST to create, PUT or PATCH to update, DELETE to remove — and stateless requests, meaning each call carries everything the server needs. JavaScript Object Notation (JSON) is the text format those calls carry: nested objects in braces, arrays in brackets, key and value pairs.

Security Information and Event Management (SIEM)

Endpoint Detection and Response (EDR)

Identity and Access Management (IAM)

Canonical phishing and alert playbook — matches out-of-the-box content

1. Ingest — fetch-incidents from the SIEM, EDR, or a mail listener. The classifier sets the type, the mapper fills the fields.
2. Deduplicate — FindSimilarIncidents and deduplication playbooks link or close duplicates.
3. Extract and enrich — auto-extraction pulls indicators, then entityEnrichment sub-playbooks for Internet Protocol (IP) address, URL, file, and domain produce DBotScore verdicts.
4. Triage and verdict — conditional tasks on scores and severity, using calculate-severity sub-playbooks.
5. Contain — usually gated by a manual approval or data-collection task: isolate the endpoint through Cortex XDR or CrowdStrike, disable the account through Active Directory or Okta, and block the indicator at the firewall or proxy.
6. Ticket and notify — create the ServiceNow ticket with mirroring enabled, and notify by Slack or email.
7. Close — close notes, root-cause field, timers stopped, post-incident report generated. Service-level metrics feed the dashboards.

Threat Intelligence Management (TIM)

Feed integrations ingest indicators on a schedule. Indicators carry expiration, verdicts, and relationships. An External Dynamic List (EDL) publishes block lists over HTTP for Palo Alto Networks firewalls and proxies to consume directly — that is the loop from intelligence to enforcement without a human in the middle.

Troubleshooting toolbox

• /debug-mode on an integration instance gives full request and response logging.
• The playbook debugger, with mocked context and breakpoints.
• Server logs at /var/log/demisto in 6.x, plus !GetServerInfo and the system diagnostics page.
• Classic failed-fetch causes: expired credentials or token, certificate verification failure, proxy blocking, a mapper or classifier mismatch, or corrupted last-run state — which is fixed by resetting last run.
• Container issues: a missing dependency means the wrong image; in hardened environments, check the container's outbound network rules.

Optimization levers — concrete, in order of impact

• Quiet mode and limiting War Room writes — the biggest database win on high-volume playbooks.
• Pre-processing rules — server-side rules at ingest that link, drop, or run a script before a playbook ever starts. The cheapest place to kill noise.
• Prefer filters and transformers over spawning scripts for trivial logic; every script means a container startup.
• Batch API calls inside integrations — one call for many indicators, not one call each.
• Context hygiene: use outputs_key_field to deduplicate, DeleteContext to drop bulky raw responses after use, and never park full email bodies or packet captures in context.
• Sizing reality: incident volume multiplied by playbook complexity drives database growth, so archive and purge policies on old incidents are part of the job.

Moving around and looking at files

Creating, copying, moving, deleting

Permissions and ownership

Searching and text processing — the analyst's toolkit

Pipes and redirection — how commands chain

Processes, services, and resources

Networking and transfer

Packages, archives, and containers

Data types — what you will be asked to name

Control flow and functions

# Indentation defines blocks — Python has no braces
if score >= 3:
    verdict = 'malicious'
elif score == 2:
    verdict = 'suspicious'
else:
    verdict = 'benign'

# Loop over a list; enumerate() gives you the index too
for i, ip in enumerate(ip_list):
    print(f'{i}: {ip}')        # f-string: inline variables

# while loops until the condition is false
while has_more_pages:
    page += 1

# A function: def, name, parameters, optional default, return
def score_indicator(value, threshold=2):
    """Docstring — what this does."""
    return value >= threshold

• break exits a loop early; continue skips to the next iteration.
• Comparison: == equal, != not equal, and, or, not, and in for membership.
• Indentation is syntax, not style. Four spaces is the standard.

Working with dictionaries and lists — the daily work

alert = {'id': 101, 'src': '10.0.0.5', 'tags': ['c2', 'beacon']}

alert['src']                 # direct access — errors if the key is missing
alert.get('user', 'unknown')  # safe access with a default — use this
alert.keys()  alert.values()  alert.items()   # iterate over parts

for key, value in alert.items():
    print(key, value)

# List comprehension — build a new list in one line
bad = [i for i in indicators if i['score'] >= 2]

# Common list operations
items.append(x)      # add one to the end
items.extend(other)  # add all of another list
len(items)           # how many
items[0]  items[-1]  items[1:3]   # first, last, slice
sorted(items, key=lambda x: x['score'], reverse=True)

The interview trap: alert['user'] raises a KeyError if the key does not exist. alert.get('user') returns None instead. In an integration parsing an unpredictable API response, always use .get().

JSON and API calls — the two libraries you will name

import json, requests

# JSON: loads = text into Python, dumps = Python into text
data = json.loads(response_text)          # string  -> dict
text = json.dumps(data, indent=2)         # dict    -> string

# A basic REST call with requests
resp = requests.get(
    'https://api.example.com/alerts',
    headers={'Authorization': f'Bearer {token}'},
    params={'limit': 50},
    timeout=30,              # always set a timeout
    verify=True               # certificate validation on
)
resp.raise_for_status()      # raise an error on 4xx / 5xx
alerts = resp.json()         # parse the body into a dict

Inside XSOAR you normally use BaseClient._http_request instead of calling requests directly, because it already handles proxy settings, certificate verification, retries, and error formatting. Knowing both, and saying why you prefer the platform one, is the strong answer.

Errors, files, and classes

# Exception handling — never let an integration die silently
try:
    result = risky_call()
except requests.Timeout:
    result = None                 # handle a specific error first
except Exception as e:
    return_error(f'Call failed: {e}')  # broad catch last
finally:
    cleanup()                     # runs either way

# Files — "with" closes the handle automatically
with open('/tmp/out.json', 'w') as f:
    f.write(json.dumps(data))

# A class: blueprint, constructor, method
class Client:
    def __init__(self, base_url, token):   # runs on creation
        self.base_url = base_url
        self.token = token

    def get(self, path):                   # self = this instance
        return requests.get(self.base_url + path)

Idioms worth having ready

• 15+ years in security. Top Secret / Sensitive Compartmented Information (TS/SCI) clearance. Department of Defense, Federal, Enterprise, Health, and Finance.
• XSOAR playbook engineering at RedMatter and Palo Alto Networks — Federal Housing Finance Agency Splunk Enterprise Security notables feeding XSOAR response pipelines — and at Xbitium across XSIAM and XDR.
• 12 terabytes per day at 150,000+ events per second (EPS); 40% reduction in Mean Time To Respond; 25 to 50% false-positive reduction.
• Python microservices built with FastAPI and Flask, REST APIs, and webhooks; detection as code through GitHub Actions — the same continuous-integration discipline that SOAR content needs.
• Preferred-skill coverage: Splunk Enterprise Security (deep), Cortex XSIAM and XDR, ServiceNow ticketing flows, and Amazon Web Services and Microsoft Azure integrations.