topic Re: closing multiple incidents with postprocessing scripts causes xsoar to hang in Cortex XSOAR Discussions

closing multiple incidents with postprocessing scripts causes xsoar to hang

EnesOzdemir — Thu, 06 Oct 2022 09:15:06 GMT

Hi all,

I am working with Carbon Black EDR so I want incidents to be closed not only on xsoar but also on carbon black instance. To achieve that I implemented a post processing script. when an incident on xsoar is closed the script closes the alert on carbon black edr too . It works fine when working with a single incident. Things get complicated when multiple incidents involved.

From the incidents page I select multiple incidents (50 incidents to be more specific) and hit close, after doing that XSOAR instance hangs and it can't pull any data (it loads web pages but no data on them). After a while I am able to view incidents again. I check to see what happened to the incidents and notice that the post processing script executed as expected but docker container timed out and failed.

I am not sure if it's a docker limitation or something else. The server has plenty of resources. What is wrong?

Re: closing multiple incidents with postprocessing scripts causes xsoar to hang

EnesOzdemir — Thu, 06 Oct 2022 10:59:20 GMT

This is another one

Re: closing multiple incidents with postprocessing scripts causes xsoar to hang

PrabirkBiswas — Fri, 20 Jan 2023 19:18:18 GMT

HI,

I was looking for some answers to another issue and found this question, I know I am quite late to answer this question. But if this helps someone who is looking for the same answer than it will be great. Since few months back I was also looking for the same answer and fixed it with some Googling.

Follow these steps to fix the issue -

Login to the XSOAR Platform.
Go to the Settings page.
Navigate to ABOUT > Troubleshooting.
Under the Server Configuration section, add these two parameters by clicking on “+ Add Server Configuration”:
- key = <name_of_integration>.<name_of_the_fucntion>.timeout, value = time out value you need , should be something higher than the time your script need to run.

Example - key = my_integration.my-multi-table-query.timeout, value = 1440

The <name_of_integration> is the name of the integration, but lowercased and replacing spaces with underscores: if its name its “My Integration v3”, then it is transformed to “my_integration_v3”.
Click on the Save button for each added property.