Palo Alto Networks Certified Security Automation Engineer (PCSAE) — Question 35

An engineer notices that playbooks only start once the user clicks the `˜investigate' button and he/she would like the playbook to start automatically.
How can this be implemented?

Answer options

• A. Add the playbook to the integration's settings
• B. Select 'Run playbook automatically' from the incident type settings
• C. Add the !startinvestigation automation to the beginning of the playbook
• D. Select 'Run playbook automatically' from the integration settings

Correct answer: B

Explanation

The correct choice, B, allows for the automatic execution of the playbook when specific incident types are created. Options A and D refer to settings that do not specifically target incident types, while option C focuses on starting an investigation manually rather than automating the process.