Query related to [HK][CCBA][232689][Finetune XSOAR playbook - Update the Group Member]

assubramania — Tue, 18 Jun 2024 02:59:38 GMT

Hi Team,

I have standard customer, their requirement is

[HK][CCBA][232689][Finetune XSOAR playbook - Update the Group Member] Customer informed that existing playbook flow is XSOAR will get the group member list from 1 device, and update the member list, then XSOAR will deploy the updated member list to ALL Fortinet devices.

Customer want to finetune the playbook to get the group member list and update the list to each Fortinet device one by one.

Please advise.

Re: Query related to [HK][CCBA][232689][Finetune XSOAR playbook - Update the Group Member]

yuki_sato — Thu, 20 Jun 2024 16:07:39 GMT

Hi @assubramania !

Anytime you want to loop within XSOAR, you will need to create a sub-playbook or loop within a script.

We recommend using the sub-playbook option for easier tracking and troubleshooting.

When you create a sub-playbook within a playbook, the task will have a Loop tab that allows you to loop for each input.

For your situation, you want to pass in two inputs: one is a list of group members and the other is a list of Fortinet devices. However, when you pass two lists into sub-playbook looping, it will grab the first item from list1 and the first item from list2, then move on to the second item from list1 and list2.

There is great documentation and a video explaining this here:

If this is not the behavior you want to achieve, you can pass the group member list as a string by combining the list into one string with commas, and then split it into a list once you pass it into the sub-playbook. This way, only the list of Fortinet devices will be looped.

Feel free to ask for clarification or any follow-up questions!

topic Query related to [HK][CCBA][232689][Finetune XSOAR playbook - Update the Group Member] in Cortex XSOAR Discussions

Query related to [HK][CCBA][232689][Finetune XSOAR playbook - Update the Group Member]

Re: Query related to [HK][CCBA][232689][Finetune XSOAR playbook - Update the Group Member]