The correct command is cytool import suex -path </local/file/path>, which imports a supplied support exception (suex) file onto a Linux endpoint, ensuring the exception is applied locally.

When running the playbook debugger with attached test data, Cortex XSIAM operates entirely in debug mode, meaning neither the original list objects nor the original context are altered. All interactions happen in an isolated debug environment to avoid impacting production data.

In a For Each Input loop, each iteration takes the next value from the list inputs while keeping constant inputs unchanged.
On the second iteration:
- x = X (second value of W,X,Y,Z)
- y = b (second value of a,b,c,d)
- z = 9 (constant for all iterations).
So, the values are X, b, 9.

When a playbook execution reaches a breakpoint on a non-manual task, you can skip the task with the breakpoint to allow the playbook to continue, or manually trigger continuation using "Run Script Now" or "Complete Manually". These actions resume execution without restarting the entire playbook.

When creating a custom incident domain in Cortex XSIAM, alert grouping still applies, allowing related alerts to be combined into incidents. However, SmartScore is not applied, since it is reserved for predefined domains.