Polling job for search results, not just search completion

[Jeff.McGurk]

I'd like to take the generic polling concept and make it a little more specific, but I'm coming up short.  I'm doing a QRadar search (although I suspect Splunk or anything else would be very similar.)  The QRadarFullSearch playbook will poll and wait for the search to finish, and that has worked great so far for what it is.  But the search can finish while not actually finding anything.  Can I somehow set some loops and polling to do the search, check for results, and then kick off a new search if no results were found?  I would still like to use the timeout value so I'm not creating an infinite loop situation.

[ABurt]

This could be done in a Playbook, or, study teh code in QRadar and create an automation script "wrapper" for the command. In essence, the script would perform the search and return a ScheduledCommand object. This causes it to re-schedule for the next run and when you finally do receive the results (or lack there of) you could optionally change the search criteria and perform the same script again.

If you kept the option to achieve this in an automation script, the ScheduledCommand can be used (even with altered arguments) and be kept within your first defined timeout.

[Jeff.McGurk · Accepted solution]

I received an answer from my resident engineer.  The QRadarFullSearch sub-playbook that I'm calling can be set up with a built-in loop to check for the presence of results.  After the playbook finishes (meaning the search has completed) it can be repeated if no results were found, with X number of seconds between runs and up to N number of retries.  I've only ever used the 'for-each input' loop criterion...I didn't realize you could make it so much smarter!

I continue to be amazed every day at the things XSOAR can do.