Cortex XSOAR playbook

demisto-py > playbook execute

Executes a Cortex XSOAR playbook with the Python client (demisto-py), automating response to Palo Alto incidents.

Run it when you want automated response with Cortex XSOAR (from Palo Alto): demisto-py (the Python client) executes the playbook on the incident — the automation (enrichment, blocking, indicator creation, notification) — and queries incidents. It's Palo Alto's SOAR platform: response orchestration with the integrations marketplace. In the SOC, Cortex XSOAR is incident automation: the executed playbook (via API or in the alert flow) reduces response time — from automated detection to action.

Don't use it without the platform: Cortex XSOAR requires the license (and instance) and integrations — infrastructure is the requirement. And watch out: the playbook automates response — the logic is designed and tested (untested playbooks generate unwanted actions); the scope (automatic blocking) is defined with the team. demisto-py (the library) has its API: consult the documentation. For interactive work, use the XSOAR interface; demisto-py for programmatic operations.