Query related to [HK][CCBA][232689][Finetune XSOAR playbook - Update the Group Member]

[assubramania]

Hi Team,

I have standard customer, their requirement is

[HK][CCBA][232689][Finetune XSOAR playbook - Update the Group Member] Customer informed that existing playbook flow is XSOAR will get the group member list from 1 device, and update the member list, then XSOAR will deploy the updated member list to ALL Fortinet devices.

Customer want to finetune the playbook to get the group member list and update the list to each Fortinet device one by one.

Please advise.

[ysato]

Hi @assubramania !

Anytime you want to loop within XSOAR, you will need to create a sub-playbook or loop within a script.

We recommend using the sub-playbook option for easier tracking and troubleshooting.

When you create a sub-playbook within a playbook, the task will have a Loop tab that allows you to loop for each input.

For your situation, you want to pass in two inputs: one is a list of group members and the other is a list of Fortinet devices. However, when you pass two lists into sub-playbook looping, it will grab the first item from list1 and the first item from list2, then move on to the second item from list1 and list2.

There is great documentation and a video explaining this here:

• Cortex XSOAR Administrator Guide
• YouTube video

If this is not the behavior you want to achieve, you can pass the group member list as a string by combining the list into one string with commas, and then split it into a list once you pass it into the sub-playbook. This way, only the list of Fortinet devices will be looped.

Feel free to ask for clarification or any follow-up questions!