topic Reruning playbook and preventing communication tasks from being rerun in Cortex XSOAR Discussions

Reruning playbook and preventing communication tasks from being rerun

michaelsysec242 — Sun, 05 Nov 2023 12:48:29 GMT

Hello All,

I have been working on the XSOAR Platform for a long time and there is something which I haven't been able to find a solution for.

I would like to rerun a playbook for multiple incidents and I use the !setPlaybook to do this. I do this after rectifying the issue on the playbook for example task error or similar. The problem is that many playbooks we are working with have a communication task such as Ask User or a Slack notification.

Is there a way to rerun the playbook and prevent the communication tasks from running?

As you can understand this can be an issue especially if the incident is not so recent therefore the communication task would be superfluous. I understand that you can re-run a stopped-on error task yet this can cause the same problem because it will reach the communication stage.

I would be interested to know if there is a way to tag or cause the communications tasks to skip only during this rerun.

Many thanks.

Re: Reruning playbook and preventing communication tasks from being rerun

MBeauchamp2 — Tue, 07 Nov 2023 15:25:26 GMT

One way I can think of is have the communication task set a value into Context using the Set automation.

Then add a conditional in front of your DC tasks that checks whether that Key is set, and bypass the task if so.

On the first run it will work, on the following runs it will skip them.

Re: Reruning playbook and preventing communication tasks from being rerun

michaelsysec242 — Sun, 12 Nov 2023 09:53:43 GMT

@MBeauchamp2 , Thanks for the insight. It is possible that I can add this flow for all playbooks no matter how laborious it is. It is a shame that there is not way to manage communication tasks from an overview level. I could look into a feature request.

I will mark your answer as a solution even though it is more of a workaround.

Cheers.