topic Re: Can run playbook in incident but not job in Cortex XSOAR Discussions

Can run playbook in incident but not job

king_penson — Wed, 05 Apr 2023 15:30:59 GMT

Currently creating a job to fetch and create an incident through an integration. The job works fine on the test server but doesn't work on production. Forcing the job to run doesn't output an error or even a record of the job attempting to run. But when I run the playbook in an incident, it works as intended.

Re: Can run playbook in incident but not job

ColeLisko — Tue, 11 Apr 2023 18:32:10 GMT

Great question.

A couple of follow up questions for you.

. What integration are you pulling from?
. Is the integration instance you're pulling from in your test server the same instance you're pulling from in your production server?

Also,

Would it be possible for your use-case to bypass using the job all together? Depending on what it is you're trying to do it may be more beneficial to tie the playbook to an incident type -> Configure your classifiers appropriately -> set the integration in questions fetch interval to the desired amount of time.

Re: Can run playbook in incident but not job

king_penson — Tue, 09 May 2023 16:08:40 GMT

Follow up answer, I had to set the Type to "Job" for it to work