Search in incidents only task with errors

[Josep]

Hello,

Is there a form to search in "Search in incidents" at "incidents" section for tasks with errors? 

Thanks 

[chrking · Accepted solution]

Try this query in the main query bar (not "Search in incidents") and it should give show you which incidents have tasks in error state:

runStatus:error

For each of the incidents you can then check the work plan or Incident Tasks fly-out (from the ... menu) for the specific task within the incident.

[ABurt]

Hi there,

You could try the dashboard named "Troubleshooting Playbooks", this will show all tasks and playbooks that have errors (as well as successes).

You can also try and attached automation script (extract the YML from the zip and import as an automation script). You provide it a search criteria (same as what would be used in the incidents search page), it will then find all erroneous tasks andPlaybooks in the incident criteria you have specified. It will output a table to the war-room and also context data that could be used in a Playbook.

Regards

Adam

[Josep]

Thanks for the reply, it works!

[Josep]

I don't know how exactly works that feature. How is "attached automation script" set? I'm curious😀

[vidurasupun]

There is automation that is part of the content pack (https://xsoar.pan.dev/marketplace/details/IntegrationsAndIncidentsHealthCheck) which you can set as a job. If you are curious of inner workings of failed task automation, you can check the code by going to Automation and searching the automation there after installing.

[ABurt]

In my reply I attached a zip file. Extract the contents of the zip file. It will be a .YML file. Then goto the automations tab and select "Upload automation":  

It will import a new automation script that you can use for searching incidents and the incident errors.

Regards

Adam

[Josep]

I tried your automation is a really good idea, and I'll use it. However, "IncidentFailedTasks" is not only for failed task query, it's for any kind of query, similiar to "SearchIncidentsV2", no?

[ABurt]

It uses the same search syntax as the Lucene query when provided as the "query" input. It will search all the incidents that match for any failed task in those incidents.

Regards

Adam