MENU
Where is the data retrieved by an integration task (such as a user's email address or a file's reputation) stored within an incident so that other playbook tasks can access it?
Context Data is a crucial architectural component of Cortex XSOAR. It acts as a temporary, JSON-formatted 'scratchpad' for each incident.
Data Flow: When a playbook task runs (e.g., !ad-get-user), the output is written to the Context Data. Subsequent tasks can then 'read' from this data to make decisions. For example, a conditional task can check if the user's department in the Context Data is 'Finance' before deciding to escalate the incident.
Persistence: Unlike the War Room (which is a chronological log of events), Context Data stores the latest state of information in a structured way that the automation engine can programmatically interact with.
Currently there are no comments in this discussion, be the first to comment!