High resource (workers) consumption using Await/Sleep tasks in XSOAR

[Josep]

Hello,

We are sending emails to users waiting for a response using the Await configuration and creating a timeout with sleep tasks. However, these pending tasks are a large number inside the XSOAR, increasing the consumption of XSOAR's resources.

[MBeauchamp2 · Accepted solution]

In this case you can set the Sleep tasks to run without a worker, under the Advanced tab of the task.  Note that you ONLY do this for sleep tasks.

But as an alternative, I would suggest using an SLA/Timer and an SLA breach script to move the playbook along in lieu of using Sleep tasks.  The advantage is SLA/Timers persist through a server restart, and have an advantage if you're sleeping for more than a few minutes. 

Checkout the CompleteTaskOnTimerBreach script that is part of the Case Management Pack - https://cortex.marketplace.pan.dev/marketplace/details/CaseManagementGeneric/

The technique (and script) is straight from the XSOAR Engineer Training series, video 18, which will show you how to use it. - https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success...

[Josep]

Thanks for the reply