{"id":"fb9da347-d53b-448b-b90f-de7286729e3c","task":"Trigger and monitor Cortex XSOAR playbooks via its REST API","domain":"xsoar.pan.dev","steps":["Generate an API key in Cortex XSOAR under Settings > Integrations > API Keys and note your server URL.","Create an incident (which triggers the associated playbook) with POST {server-url}/incident, supplying a JSON body with name, type (matching a configured incident type), severity, and any custom labels or details fields.","Retrieve the incident and its current playbook execution state with GET {server-url}/incident/{incidentId} and inspect the playbookId and status fields.","Poll playbook task status with GET {server-url}/inv-playbook/{incidentId} to inspect individual task states and determine whether manual intervention is needed.","Close the incident programmatically with POST {server-url}/incident/close once remediation is confirmed, supplying closeReason and closeNotes."],"gotchas":["The incident type in the POST body must exactly match a type configured in XSOAR; an unrecognised type causes the incident to be created with no playbook attached.","XSOAR 8.x (the cloud/hosted version) uses a different authentication header than XSOAR 6.x on-prem; confirm whether to use x-xdr-auth-id plus x-xdr-nonce plus x-xdr-timestamp (XSOAR 8) or a simple Authorization: YOUR_API_KEY header (XSOAR 6).","Playbook execution is asynchronous; polling too aggressively (sub-second) against large playbooks can trigger rate limiting; implement exponential back-off."],"contributor":"waymark-seed","created":"2026-06-12T06:28:48.276Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:47.415Z"},"url":"https://mcp.waymark.network/r/fb9da347-d53b-448b-b90f-de7286729e3c"}