topic Re: Search in incidents only task with errors in Cortex XSOAR Discussions

Search in incidents only task with errors

Josep — Fri, 09 Sep 2022 12:35:21 GMT

Hello,

Is there a form to search in "Search in incidents" at "incidents" section for tasks with errors?

Thanks

Re: Search in incidents only task with errors

chrking — Mon, 12 Sep 2022 01:32:22 GMT

Try this query in the main query bar (not "Search in incidents") and it should give show you which incidents have tasks in error state:

runStatus:error

For each of the incidents you can then check the work plan or Incident Tasks fly-out (from the ... menu) for the specific task within the incident.

Re: Search in incidents only task with errors

ABurt — Mon, 12 Sep 2022 08:05:49 GMT

Hi there,

You could try the dashboard named "Troubleshooting Playbooks", this will show all tasks and playbooks that have errors (as well as successes).

You can also try and attached automation script (extract the YML from the zip and import as an automation script). You provide it a search criteria (same as what would be used in the incidents search page), it will then find all erroneous tasks andPlaybooks in the incident criteria you have specified. It will output a table to the war-room and also context data that could be used in a Playbook.

Regards

Adam

Re: Search in incidents only task with errors

Josep — Mon, 12 Sep 2022 16:58:57 GMT

Thanks for the reply, it works!

Re: Search in incidents only task with errors

Josep — Mon, 12 Sep 2022 17:04:23 GMT

I don't know how exactly works that feature. How is "attached automation script" set? I'm curious😀

Re: Search in incidents only task with errors

vidurasupun — Tue, 13 Sep 2022 04:00:34 GMT

There is automation that is part of the content pack (https://xsoar.pan.dev/marketplace/details/IntegrationsAndIncidentsHealthCheck) which you can set as a job. If you are curious of inner workings of failed task automation, you can check the code by going to Automation and searching the automation there after installing.

Re: Search in incidents only task with errors

ABurt — Tue, 13 Sep 2022 09:49:56 GMT

In my reply I attached a zip file. Extract the contents of the zip file. It will be a .YML file. Then goto the automations tab and select "Upload automation":

It will import a new automation script that you can use for searching incidents and the incident errors.

Regards

Adam

Re: Search in incidents only task with errors

Josep — Tue, 13 Sep 2022 10:42:30 GMT

I tried your automation is a really good idea, and I'll use it. However, "IncidentFailedTasks" is not only for failed task query, it's for any kind of query, similiar to "SearchIncidentsV2", no?

Re: Search in incidents only task with errors

ABurt — Tue, 13 Sep 2022 12:10:15 GMT

It uses the same search syntax as the Lucene query when provided as the "query" input. It will search all the incidents that match for any failed task in those incidents.

Regards

Adam