- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
09-09-2022 05:35 AM
Hello,
Is there a form to search in "Search in incidents" at "incidents" section for tasks with errors?
Thanks
09-11-2022 06:32 PM
Try this query in the main query bar (not "Search in incidents") and it should give show you which incidents have tasks in error state:
runStatus:error
For each of the incidents you can then check the work plan or Incident Tasks fly-out (from the ... menu) for the specific task within the incident.
09-11-2022 06:32 PM
Try this query in the main query bar (not "Search in incidents") and it should give show you which incidents have tasks in error state:
runStatus:error
For each of the incidents you can then check the work plan or Incident Tasks fly-out (from the ... menu) for the specific task within the incident.
09-12-2022 01:05 AM
Hi there,
You could try the dashboard named "Troubleshooting Playbooks", this will show all tasks and playbooks that have errors (as well as successes).
You can also try and attached automation script (extract the YML from the zip and import as an automation script). You provide it a search criteria (same as what would be used in the incidents search page), it will then find all erroneous tasks andPlaybooks in the incident criteria you have specified. It will output a table to the war-room and also context data that could be used in a Playbook.
Regards
Adam
09-12-2022 09:58 AM
Thanks for the reply, it works!
09-12-2022 10:04 AM
I don't know how exactly works that feature. How is "attached automation script" set? I'm curious😀
09-12-2022 09:00 PM
There is automation that is part of the content pack (https://xsoar.pan.dev/marketplace/details/IntegrationsAndIncidentsHealthCheck) which you can set as a job. If you are curious of inner workings of failed task automation, you can check the code by going to Automation and searching the automation there after installing.
09-13-2022 02:49 AM
In my reply I attached a zip file. Extract the contents of the zip file. It will be a .YML file. Then goto the automations tab and select "Upload automation":
It will import a new automation script that you can use for searching incidents and the incident errors.
Regards
Adam
09-13-2022 03:42 AM
I tried your automation is a really good idea, and I'll use it. However, "IncidentFailedTasks" is not only for failed task query, it's for any kind of query, similiar to "SearchIncidentsV2", no?
09-13-2022 05:10 AM
It uses the same search syntax as the Lucene query when provided as the "query" input. It will search all the incidents that match for any failed task in those incidents.
Regards
Adam
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!