topic Setting up a counter in XSOAR in Cortex XSOAR Discussions

Setting up a counter in XSOAR

AVaduva11 — Wed, 06 Dec 2023 12:26:03 GMT

Hello,

So we have a playbook that is meant to send alerts via email in strikes. In each strike there is a link to a survey that has only YES/NO answers and based on the answers given be the recipients of those emails we want the playbook to follow a path.

We thought that we might need a counter and timer for this specific task, for example, regarding the timer let's say I want to setup a 15 minutes timeframe, the first user to receive the email answers with no and after few minutes(within those 15minutes), 2 other users will answers with yes. I want those 2 yes answers to be taken in consideration and follow the path for closing the playbook and not going to the second strike email.

Thank you so much!

Re: Setting up a counter in XSOAR

MBeauchamp2 — Mon, 11 Dec 2023 15:54:01 GMT

You could use a builtin loop, and have it update a counter on each go around, there is an example in video 12:

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/tkb-p/Cortex_XSOAR_How_to_Videos

For your data collection task (assuming that's what you're using), you can specify to move on after receiving X number of replies AND/OR a given SLA.

You'd just need a conditional to check the responses and if you got enough of them, and either set the condition to break the builtin loop, or to repeat it. Just make sure to manage your context appropriately on each loop.

Re: Setting up a counter in XSOAR

AVaduva11 — Tue, 12 Dec 2023 11:24:54 GMT

Thank you! I will try and let u know how it went