topic How to run playbook on scheduled interval for all XSOAR Incidents? in Cortex XSOAR Discussions

How to run playbook on scheduled interval for all XSOAR Incidents?

SHadfa — Thu, 19 Jan 2023 18:20:58 GMT

Hello team, I've use-case where I need to fetch related events for a particular incident periodically.

For that, I've prepared a playbook which will pull the events related to each XSOAR incident and link that data in Contex of a particular XSOAR incident. As this needs to be applied to all incidents of selected custom incident type and I want my playbook to run all the XSOAR incidents on some cron schedule. I've tried to run using time triggered jobs but it seems not working properly as it's triggering my playbook once instead of schedule.

Is there anything additional we need to add in the playbook to trigger on corn job?

Is there any way to achieve this use case?

Re: How to run playbook on scheduled interval for all XSOAR Incidents?

amontminy — Thu, 19 Jan 2023 22:26:24 GMT

Hi Shadfa, when creating a time triggered job there is a section at the very bottom for queue handling. By default, the job will not run again until the first incident is closed. There is an option in the queue handling section to allow the job to run concurrently so even if the first incident is not closed, a new one will be created that uses your playbook.

Re: How to run playbook on scheduled interval for all XSOAR Incidents?

SHadfa — Fri, 20 Jan 2023 10:58:07 GMT

This will not resolve my case. As this will create a new incident and run playbook job there. Where I want to run same playbook on Same incident in scheduled manner.

Re: How to run playbook on scheduled interval for all XSOAR Incidents?

arnarayanan — Fri, 20 Jan 2023 13:45:45 GMT

What you could potentially do is in the main playbook of the incident, use a scheduled command that queries the remote system periodically and update the incident if there are new entries from the remote. And upon incident close run a post processing script to close the scheduled command task using !taskComplete.
https://xsoar.pan.dev/docs/integrations/scheduled-commands

So the polling is handled in the playbook of the incident itself and the playbook does not complete until the incident is closed

Re: How to run playbook on scheduled interval for all XSOAR Incidents?

nikoolayy1 — Sun, 22 Jan 2023 13:15:43 GMT

Also maybe test to get the time as it will always be different, so a nice way to trigger each time the playbook.

https://xsoar.pan.dev/docs/reference/scripts/get-time