topic Re: Recurring automation on active tickets in Cortex XSOAR Discussions

Recurring automation on active tickets

G.Buis — Wed, 17 Jul 2024 14:38:00 GMT

I'm trying to run an automation every hour which checks for Warroom entries and executes certain code in the automation. This automation should only run and check on the active tickets. The automation itself works, but I still need to execute it with a command in the Warroom at the moment. I've created a job that runs every hour, but I can't seem to link the automation script to it.

Can someone explain to me how I can execute an automation every hour within XSOAR?

Re: Recurring automation on active tickets

MEiunyo1 — Thu, 18 Jul 2024 00:07:51 GMT

Hi,@G.Buis

Would the information on this page be of help to you?

Automating XSOAR: Running Scripts Every Hour (trycatchdebug.net)

Re: Recurring automation on active tickets

G.Buis — Thu, 18 Jul 2024 07:56:30 GMT

Hi @MEiunyo1, thanks for your reply and the oddly specific webpage 😉

I've checked on different XSOAR versions (6.6.0 and 6.12.0), but in both versions I cannot find the 'schedule' button.

Let me retrace my steps to see where I go wrong.

1. I log in to the XSOAR application

2. In the left sidebar, I click 'Automation'.

3. I find my script in the 'Automation Library' and highlight it. The script opens on the right side of the screen.

4. I cannot see a schedule button anywhere, the only options are 'Settings', Version history (icon), 'Edit' and 3 dots: Duplicate, Download or Delete Automation.

Would this mean that I need to upgrade my XSOAR version to see this button? Or am I just overlooking it anywhere?

A follow up question I'd like to ask already:

To my assumption this will be a general script and not tied to a specific playbook. Am I correct in assuming that this would mean that I would have to run the script against all of the active tickets, instead of the script only running on active tickets?

Re: Recurring automation on active tickets

MEiunyo1 — Thu, 18 Jul 2024 09:47:50 GMT

Thanks for the reply, @G.Buis.
The page looked helpful, but I also checked and could not find the schedule button. (version 6.12.0)
Sorry for giving you incorrect information.

What about running the command ScheduleCommand within WarRoom?
I have tried that and I am able to run Automation periodically within Warroom.

(I have Automation running every minute to see how it works, and so far it has been successful.)

GUI image

I do not have a definitive answer to the follow-up question. Sorry.

Re: Recurring automation on active tickets

G.Buis — Thu, 18 Jul 2024 11:47:41 GMT

Hi @MEiunyo1

Thanks again for your reply. This would help, however I want to automatically run this automation on every active ticket, and (most importantly) every new ticket.

My goal is to set a replyStatus field when the customer replied to the ticket, to 'Customer replied' (which other scripts would act on), and set it to 'Waiting for Customer' when we replied. I want to check every active ticket every (half?) hour for replies, so we can filter out only what we need to see.

I hope for another of your suggestions, thanks in advance!