Using "GetFailedTasks" with a relative time range of 7 or 30 days lookback

michaelsysec242 — Thu, 02 Nov 2023 10:04:31 GMT

Hello all,

I am working with the task 'GetFailedTasks' withing the Integrations & Incidents Health Check playbook. When running this task within this system playbook I am only getting failed tasks from the beginning of the year and this is likely due to the Max_incidents flag for this task. How would I go about adding to the query a relative time-frame of 7 or 30 days so that I can view and analyze only recent failing tasks?

I have checked on another XSOAR deployment and the Playbook retrieves only recent incidents. Is this a bug or this is something that can be changed ?

Take note, I have upgraded the content pack to the latest versions and can confirm that the playbook remains attached.

Many thanks

Re: Using "GetFailedTasks" with a relative time range of 7 or 30 days lookback

AbelSantamarina — Wed, 13 Dec 2023 17:59:45 GMT

@michaelsysec242,

The GetFailedTasks command takes in as argument a query, which you can edit to include a timeframe of interest. For example, if you'd like to get the failed tasks within the last 7 days, you can edit the query parameter and use:

-status:closed and runStatus:error and incident.created:>="7 days ago"

If you're using the Out of the Box playbook "Integrations and Incidents Health Check - Running Scripts", you will need to duplicate it or detach it as it is locked, in order to change the query in the task.

topic Re: Using "GetFailedTasks" with a relative time range of 7 or 30 days lookback in Cortex XSOAR Discussions

Using "GetFailedTasks" with a relative time range of 7 or 30 days lookback

Re: Using "GetFailedTasks" with a relative time range of 7 or 30 days lookback