https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/xsoar-8-cloud-content-performance-analysis/ta-p/620285 <DIV class="lia-message-template-content-zone"> <P class="lia-align-center" style="color: #3e3e3e;" dir="ltr"><FONT size="6" color="#FF6600"><STRONG>By&nbsp;<SPAN>Randy Uhrlaub,&nbsp;</SPAN>Customer Success Architect</STRONG></FONT></P> <P class="lia-align-center" style="color: #3e3e3e;" dir="ltr">&nbsp;</P> <P style="color: #3e3e3e;" dir="ltr"><FONT color="#FF6600"><STRONG><FONT size="6">Table Of Content</FONT></STRONG></FONT></P> <P>&nbsp;</P> <P><LI-TOC indent="10" liststyle="square" maxheadinglevel="3"></LI-TOC></P> <P dir="ltr">&nbsp;</P> <H2 dir="ltr"><STRONG><FONT color="#FF6600">Review Data</FONT></STRONG></H2> <P>&nbsp;</P> <P dir="ltr"><SPAN>XSOAR has several areas in the console that provide insight into performance of the configuration and content. Review these and the associated dashboards to identify areas to investigate performance.&nbsp; Are there excessive integration commands or is there a playbook or automation used extensively consuming significant resources?</SPAN></P> <H3 dir="ltr">&nbsp;</H3> <H2 dir="ltr"><STRONG><FONT color="#FF6600">Settings and Info</FONT></STRONG></H2> <P>&nbsp;</P> <H2 dir="ltr"><STRONG><FONT color="#FF6600">Guardrails</FONT></STRONG></H2> <P>&nbsp;</P> <P dir="ltr"><SPAN>In XSOAR 8.8 Cloud and On-Premise, the Guard Rails page at&nbsp;</SPAN><SPAN>Settings &amp; Info &gt; Settings &gt; Guardrails</SPAN><SPAN>&nbsp;provides a list of thresholds and warnings that occur during incident ingestion, investigation, and response. It helps to keep your environment stable and prevent actions that can cause major performance degradation or instability. The list of service limit errors and warnings is regularly updated to support ongoing changes in your environment.</SPAN></P> <P>&nbsp;</P> <H2 dir="ltr"><STRONG><FONT color="#FF6600">System Diagnostics</FONT></STRONG></H2> <P>&nbsp;</P> <P dir="ltr"><SPAN>With XSOAR 8.8 On-Premise,&nbsp;</SPAN><SPAN>Settings &amp; Info &gt; Settings &gt; System Diagnostics</SPAN><SPAN>&nbsp;provides insight into resource consumption on a per-node basis.</SPAN></P> <P dir="ltr">&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="unnamed.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/64000iFBDCE96DF5300326/image-size/large?v=v2&amp;px=999" role="button" title="unnamed.jpg" alt="unnamed.jpg" /></span></P> <P><FONT color="#FF6600"><SPAN>Figure 01:&nbsp; On-Premise System Diagnostics_<WBR />PaloAltoNetworks</SPAN></FONT></P> <P dir="ltr">&nbsp;</P> <H2 dir="ltr"><STRONG><FONT color="#FF6600">Integrations</FONT></STRONG></H2> <P>&nbsp;</P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>Are integration instance queries optimized to fetch only needed alerts for incidents and are the sampling frequency reasonable?</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Are threat feed instances configured to return only required indicators and are the sampling frequency reasonable?</SPAN></P> </LI> </UL> <P>&nbsp;</P> <H2 dir="ltr"><STRONG><FONT color="#FF6600">Dashboards</FONT></STRONG></H2> <P>&nbsp;</P> <P dir="ltr"><SPAN>Cost Optimization Instances</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>Top Executed Commands</SPAN></P> </LI> </UL> <P>&nbsp;</P> <P dir="ltr"><SPAN>Troubleshooting Instances</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>Average runtime per Instance by Command (top 5)</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Average runtime per Instance (top 5)</SPAN></P> </LI> </UL> <H3 dir="ltr">&nbsp;</H3> <H2 dir="ltr"><STRONG><FONT color="#FF6600">Incidents</FONT></STRONG></H2> <P>&nbsp;</P> <P dir="ltr"><SPAN>The main drivers of performance are:</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>Large work plans (&gt; 3 MB) which scales based on the number of tasks and size of task inputs and outputs</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Large context &gt; 1 MB</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Adding entries/artifacts to the war room - scales with the number of tasks and quiet mode setting for each task</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Indicator extraction and enrichment - scales with N indicators times M threat feed instances supporting the common enrichment commands (</SPAN><SPAN>ip</SPAN><SPAN>, </SPAN><SPAN>domain</SPAN><SPAN>, …) and feed instance configured to be used by default</SPAN></P> </LI> </UL> <P>&nbsp;</P> <P dir="ltr"><SPAN>Best practices:</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>Use latest playbook and script versions</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Break up large playbooks into sub-playbooks</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Remove unused playbook tasks</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Set the playbook to run in quiet mode</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Only extract indicators when needed</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Minimize disk usage, CPU usage, and API calls</SPAN></P> </LI> </UL> <P>&nbsp;</P> <P dir="ltr"><SPAN>The following automation is used to investigate incident size:</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>IncidentSizeX8</SPAN><SPAN> (for XSOAR 8 )</SPAN></P> </LI> </UL> <P>&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="unnamed.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/64001iC4FAB3C4D1CCE0AF/image-size/large?v=v2&amp;px=999" role="button" title="unnamed.jpg" alt="unnamed.jpg" /></span></P> <P dir="ltr"><FONT color="#FF6600"><SPAN>Figure 02:&nbsp; Incident Size_PaloAltoNetworks</SPAN></FONT></P> <P>&nbsp;</P> <P dir="ltr"><SPAN>To look at big work plan objects at the task level, the following command is used:</SPAN><SPAN>&nbsp;</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>!getInvPlaybookMetaData incidentId=</SPAN><SPAN>"&lt;incident ID&gt;</SPAN><SPAN>" minSize="</SPAN><SPAN>&lt;min size to return&gt;</SPAN><SPAN>"</SPAN></P> </LI> </UL> <P dir="ltr">&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="unnamed.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/64002i49EE731023EDCA39/image-size/large?v=v2&amp;px=999" role="button" title="unnamed.jpg" alt="unnamed.jpg" /></span></P> <P dir="ltr"><FONT color="#FF6600"><SPAN>Figure 03:&nbsp; PlaybookMetaData_<WBR />PaloAltoNetworks</SPAN></FONT></P> <P>&nbsp;</P> <P dir="ltr"><SPAN>SLAs can be defined to specify time requirements for workflows such as “time to remediation” and alert when an SLA is breached. Dashboards can be used to monitor SLAs and improvement over time.</SPAN></P> <P>&nbsp;</P> <H2 dir="ltr"><STRONG><FONT color="#FF6600">Dashboards</FONT></STRONG></H2> <P>&nbsp;</P> <P dir="ltr"><SPAN>Cost Optimization Playbooks</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>Average runtime per Playbook (top 5)</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Average runtime by&nbsp; Incident Type per Playbook&nbsp; (top 5)</SPAN></P> </LI> </UL> <P>&nbsp;</P> <P dir="ltr"><SPAN>XSOAR Value Metrics&nbsp;</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>Average Incident Duration</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>Average SLA</SPAN></P> </LI> </UL> <P>&nbsp;</P> <P dir="ltr"><SPAN>CISO Metrics</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>Average Duration by Incident Type</SPAN></P> </LI> </UL> <H2 dir="ltr">&nbsp;</H2> <H2 dir="ltr"><STRONG><FONT color="#FF6600">Automation Performance Analysis</FONT></STRONG></H2> <P>&nbsp;</P> <P dir="ltr"><SPAN>Automations are profiled using the&nbsp;</SPAN><SPAN>Simple Debugger</SPAN><SPAN>&nbsp;content pack to identify hot spots for potential optimization.&nbsp; Use the&nbsp;</SPAN><SPAN>profile</SPAN><SPAN>,&nbsp;</SPAN><SPAN>quiet</SPAN><SPAN>, and&nbsp;</SPAN><SPAN>nolog</SPAN><SPAN>&nbsp;inputs during performance analysis to minimize debugger overhead.&nbsp;</SPAN></P> <P>&nbsp;</P> <P dir="ltr"><SPAN>Dashboards are used to assist identification of automations for analysis.&nbsp; Playbook performance analysis may also identify automations for further investigation.</SPAN></P> <P dir="ltr">&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="unnamed.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/64004i60B447DD87BA5215/image-size/large?v=v2&amp;px=999" role="button" title="unnamed.jpg" alt="unnamed.jpg" /></span></P> <P dir="ltr"><FONT color="#FF6600"><SPAN>Figure 04:&nbsp; Simple Debugger_<WBR />PaloAltoNetworks</SPAN></FONT></P> <P>&nbsp;</P> <H2 dir="ltr"><STRONG><FONT color="#FF6600">Dashboards</FONT></STRONG></H2> <P>&nbsp;</P> <P dir="ltr"><SPAN>Troubleshooting Instances</SPAN></P> <P>&nbsp;</P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>Average runtime per Automation(top 5)</SPAN></P> </LI> </UL> <H2 dir="ltr">&nbsp;</H2> <H2 dir="ltr"><FONT color="#FF6600"><STRONG>Playbook Performance Analysis</STRONG></FONT></H2> <P>&nbsp;</P> <P dir="ltr"><SPAN>The&nbsp;</SPAN><SPAN>Content Testing&nbsp;</SPAN><SPAN>content pack contains a playbook analyzer tool that computes minimum, average, and maximum task durations in a specific playbook or sub-playbooks invoked in incidents covering a specified time window.&nbsp; Hot spot tasks are clearly identified.</SPAN></P> <P>&nbsp;</P> <P dir="ltr"><SPAN>Baselining task durations in critical playbooks or sub-playbooks prior to optimization efforts allows assessing the performance impact of changes. </SPAN></P> <P dir="ltr">&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="unnamed.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/64005i6A057CF43E7F5DC9/image-size/large?v=v2&amp;px=999" role="button" title="unnamed.jpg" alt="unnamed.jpg" /></span></P> <P dir="ltr"><FONT color="#FF6600"><SPAN>Figure 05:&nbsp; Playbook Performance Analysis_<WBR />PaloAltoNetworks</SPAN></FONT></P> <H2><BR /><SPAN>Resources</SPAN></H2> <P>&nbsp;</P> <P dir="ltr"><SPAN>Best Practices</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Best-practices" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Best-practices&amp;source=gmail&amp;ust=1731719327113000&amp;usg=AOvVaw2lPwjq7JeB8mOunBF3Dwjl"><SPAN>Cortex XSOAR: best practices</SPAN></A><SPAN>&nbsp;</SPAN></P> </LI> </UL> <P dir="ltr"><SPAN>Guardrails</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/View-service-limit-errors-and-warnings-on-the-Guard-Rails-page" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/View-service-limit-errors-and-warnings-on-the-Guard-Rails-page&amp;source=gmail&amp;ust=1731719327113000&amp;usg=AOvVaw39i77GmYDmpjPTgOyPbXoK"><SPAN>View service limit errors and warnings on the Guard Rails page</SPAN></A><SPAN>&nbsp;</SPAN></P> </LI> </UL> <P dir="ltr"><SPAN>Indicator Extraction:</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Indicator-extraction" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Indicator-extraction&amp;source=gmail&amp;ust=1731719327113000&amp;usg=AOvVaw1dXdI8oaaGAtwQ8k78W3it"><SPAN>Indicator extraction</SPAN></A><SPAN>&nbsp;</SPAN></P> </LI> </UL> <P dir="ltr">&nbsp;</P> <P dir="ltr"><SPAN>Content Packs</SPAN></P> <P>&nbsp;</P> <P dir="ltr"><SPAN>Common Dashboards</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><A href="https://cortex.marketplace.pan.dev/marketplace/details/CommonDashboards" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://cortex.marketplace.pan.dev/marketplace/details/CommonDashboards&amp;source=gmail&amp;ust=1731719327113000&amp;usg=AOvVaw0wvy0GI7oBnbq-a0ZzfNxs"><SPAN>Common Dashboards Pack</SPAN></A><SPAN>&nbsp;</SPAN></P> </LI> </UL> <P dir="ltr"><SPAN>Community Common Dashboards</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><A href="https://cortex.marketplace.pan.dev/marketplace/details/CommunityCommonDashboards" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://cortex.marketplace.pan.dev/marketplace/details/CommunityCommonDashboards&amp;source=gmail&amp;ust=1731719327113000&amp;usg=AOvVaw0totx_BBzXjtGOxH668iiE"><SPAN>Community Common Dashboards Pack</SPAN></A><SPAN>&nbsp;</SPAN></P> </LI> </UL> <P dir="ltr"><SPAN>Content Testing</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>&nbsp;</SPAN><A href="https://cortex.marketplace.pan.dev/marketplace/details/ContentTesting" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://cortex.marketplace.pan.dev/marketplace/details/ContentTesting&amp;source=gmail&amp;ust=1731719327113000&amp;usg=AOvVaw0luQ_yJJMctxAIKhuUfJnC"><SPAN>Content Testing Pack</SPAN></A><SPAN>&nbsp;</SPAN></P> </LI> </UL> <P dir="ltr"><SPAN>Simple Debugger</SPAN></P> <UL> <LI dir="ltr"> <P dir="ltr"><A href="https://cortex.marketplace.pan.dev/marketplace/details/SimpleDebugger" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://cortex.marketplace.pan.dev/marketplace/details/SimpleDebugger&amp;source=gmail&amp;ust=1731719327113000&amp;usg=AOvVaw0FVdbGk1dOcGzO841w3JfJ"><SPAN>Simple Debugger Pack</SPAN></A><SPAN>&nbsp;</SPAN></P> </LI> </UL> <P>&nbsp;</P> <P dir="ltr"><SPAN>Automations</SPAN></P> <P>&nbsp;</P> <UL> <LI dir="ltr"> <P dir="ltr"><SPAN>IncidentSizeX8</SPAN><SPAN> (custom)</SPAN></P> </LI> <LI dir="ltr"> <P dir="ltr"><SPAN>getInvPlaybookMetaData</SPAN><SPAN> (standard)</SPAN></P> </LI> </UL> <DIV class="yj6qo">&nbsp;</DIV> <DIV class="adL">&nbsp;</DIV> </DIV> Fri, 11 Apr 2025 02:13:42 GMT RPrasadi 2025-04-11T02:13:42Z https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/xsoar-8-cloud-content-performance-analysis/ta-p/620285 <P><SPAN>XSOAR has several areas in the console that provide insight into performance of the configuration and content. Review these and the associated dashboards to identify areas to investigate performance.&nbsp; Are there excessive integration commands or is there a playbook or automation used extensively consuming significant resources?</SPAN></P> Fri, 11 Apr 2025 02:13:42 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/xsoar-8-cloud-content-performance-analysis/ta-p/620285 RPrasadi 2025-04-11T02:13:42Z