topic Error handling in Cortex XSOAR Discussions

Error handling

c.marlettalivi — Thu, 17 Nov 2022 17:23:41 GMT

Hi all, with this type of setting (see the img), if in the next task I check $ {lastCompletedTaskEntries} to verify if the previous task is in error, the result is positive even if the second retry task went well. How can I get around this problem?

Re: Error handling

jfernandes1 — Thu, 17 Nov 2022 23:33:20 GMT

Hi @c.marlettalivi, that is by design. The ${lastCompletedTaskEntries} returns the ID of the last warroom entry created by the previous playbook task. If you want to check individual task run, I would suggest going the playbook loop approach. Inside the sub-playbook set the task with no retries, your error check task should follow this task, then in your master playbook create the loop with a conditional check.

Refer - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-admin/playbooks/configure-a-sub-playbook-loop for more information.

Re: Error handling

c.marlettalivi — Fri, 18 Nov 2022 10:06:31 GMT

Thank you @jfernandes1 . I would like to be able to send an email if none of the retries ends without errors.

Does the management with 'Error path' also behave in this way?

Re: Error handling

c.marlettalivi — Fri, 18 Nov 2022 10:06:40 GMT

Thank you @jfernandes1 . I would like to be able to send an email if none of the retries ends without errors.

Does the management with 'Error path' also behave in this way?

Re: Error handling

jfernandes1 — Tue, 22 Nov 2022 00:04:42 GMT

Hi @c.marlettalivi, The use case you're asking for is not possible with error path. As mentioned before, if you want to test each retry you should do this via the sub-playbook method.

Re: Error handling

MBeauchamp2 — Mon, 28 Nov 2022 16:30:33 GMT

They also introduced error handling playbooks in version 6.8. You can add an error path after the task, which will be followed if it errors:

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-8/cortex-xsoar-admin/playbooks/playbook-tasks/handle-errors-in-a-playbook