topic Re: War Room showing limited outputs in Cortex XSOAR Discussions

War Room showing limited outputs

Josep — Thu, 21 Sep 2023 12:00:37 GMT

Hello,

We are executing a long playbook. This playbook started to work incorrectly. To check what was happening, we looked inside the War Room, but it only showed a limited number of outputs. In order to check more outputs, we had to scroll up inside the War Room, however, it took too long to load just a couple of new outputs. How can we obtain all the War Room outputs directly?

Re: War Room showing limited outputs

gyldz — Tue, 26 Sep 2023 11:51:40 GMT

Hi @Josep ,

You can run the below automation in the incident's war room to get entries in JSON format.

!GetEntries raw-response=true

I hope this answers your question.

Re: War Room showing limited outputs

Josep — Tue, 26 Sep 2023 15:24:02 GMT

Hello @gyldz , thanks for your response.

Inside the json there are all the entries. However, if the war room is huge it's impossible to visualize the data.

Re: War Room showing limited outputs

jfernandes1 — Fri, 29 Sep 2023 04:42:07 GMT

Hi @Josep, you can also see the warroom entries by going to the workplan and clicking on a specific task(1). I would suggest that as the best way to troubleshoot a playbook. Once the task is open, you can click the command in blue(2) to go its location in the warroom. For task that do not have the command you can URL in the 3-dot menu(3).

On a side note, playbooks should be set to quite mode to ensure that you get the best performance during a run. It reduces the overall incident and warroom size.

In your current scenario, I would suggest to enable quite mode for the entire playbook, then override the setting like below in tasks that you wish to debug. Also, some task like onError, EmailAskUser, etc. require quite mode to be turned off.