topic Re: Automation in Python using parallel processing in Cortex XSOAR Discussions

Automation in Python using parallel processing

sdes — Fri, 08 Dec 2023 08:04:59 GMT

#Cortex XSOAR

Hi,

Is there a way of creating parallel processing inside an automation in Python ?

My goal is to execute the same function on multiple incidents (pausing and/or starting timers).

The thing is, sometimes we have a lot of incidents and the current automation using a mere "for x in y" can timeout.

Obviously we could increase the timeout and/or retry on error but for the same number of incidents it can take from 3 to more than 10 minutes (we do not know the reason)

It seems we can import "Process" or "Threading". While Process does not seems to work, Threading does but without time improvement.

Many thanks for your help.

Best regards,

Re: Automation in Python using parallel processing

Ivetto — Fri, 19 Jan 2024 20:43:24 GMT

Hello,

Are your system specs up to requirement? Please take a look at this doc to ensure you have the minimum recommended specs https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.12/Cortex-XSOAR-Installation-Guide/Installation-Overview

The reason for this is that every single task in XSOAR requires a worker and if there are no workers available you could see these sort of issues occurring. However, if this a concern with a specific task that is timing out I would recommend to create a support ticket to ensure that there isn't something else going on that needs to be addressed before any more complication gets introduced into the equation.

Furthermore, I do not recommend creating a script with multithreading capabilities or that works on multiple incidents at the same time as this would interrupt the flow of logical execution of each incident. XSOAR is not made for this sort of execution and troubleshooting it would not be supported by any of our OOTB debugging tools.

Re: Automation in Python using parallel processing

nitin.maurya — Sun, 21 Jan 2024 21:06:24 GMT

For this you need to

demisto.executeCommand("getIncidents", { 'query':query_inc, 'fromdate': from_date, 'populateFields' : 'your fields' })

Above command will get your required incidents information then get incident ids of it.
Make your function and run it over your incident ids using setPlaybook.