Hello team, I've use-case where I need to fetch related events for a particular incident periodically.
For that, I've prepared a playbook which will pull the events related to each XSOAR incident and link that data in Contex of a particular XSOAR incident. As this needs to be applied to all incidents of selected custom incident type and I want my playbook to run all the XSOAR incidents on some cron schedule. I've tried to run using time triggered jobs but it seems not working properly as it's triggering my playbook once instead of schedule.
Is there anything additional we need to add in the playbook to trigger on corn job?
Is there any way to achieve this use case?
Hi Shadfa, when creating a time triggered job there is a section at the very bottom for queue handling. By default, the job will not run again until the first incident is closed. There is an option in the queue handling section to allow the job to run concurrently so even if the first incident is not closed, a new one will be created that uses your playbook.
This will not resolve my case. As this will create a new incident and run playbook job there. Where I want to run same playbook on Same incident in scheduled manner.
What you could potentially do is in the main playbook of the incident, use a scheduled command that queries the remote system periodically and update the incident if there are new entries from the remote. And upon incident close run a post processing script to close the scheduled command task using !taskComplete.
So the polling is handled in the playbook of the incident itself and the playbook does not complete until the incident is closed
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!