Search in incidents only task with errors

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Search in incidents only task with errors

L4 Transporter

Hello,

Is there a form to search in "Search in incidents" at "incidents" section for tasks with errors? 

Thanks 

1 accepted solution

Accepted Solutions

L3 Networker

Try this query in the main query bar (not "Search in incidents") and it should give show you which incidents have tasks in error state:

runStatus:error

 

For each of the incidents you can then check the work plan or Incident Tasks fly-out (from the ... menu) for the specific task within the incident.

View solution in original post

8 REPLIES 8

L3 Networker

Try this query in the main query bar (not "Search in incidents") and it should give show you which incidents have tasks in error state:

runStatus:error

 

For each of the incidents you can then check the work plan or Incident Tasks fly-out (from the ... menu) for the specific task within the incident.

L3 Networker

Hi there,

 

You could try the dashboard named "Troubleshooting Playbooks", this will show all tasks and playbooks that have errors (as well as successes).

Screenshot 2022-09-12 at 09.04.55.png

You can also try and attached automation script (extract the YML from the zip and import as an automation script). You provide it a search criteria (same as what would be used in the incidents search page), it will then find all erroneous tasks andPlaybooks in the incident criteria you have specified. It will output a table to the war-room and also context data that could be used in a Playbook.

 

Regards


Adam

Thanks for the reply, it works!

I don't know how exactly works that feature. How is "attached automation script" set? I'm curious😀

 

There is automation that is part of the content pack (https://xsoar.pan.dev/marketplace/details/IntegrationsAndIncidentsHealthCheck) which you can set as a job. If you are curious of inner workings of failed task automation, you can check the code by going to Automation and searching the automation there after installing.

 

In my reply I attached a zip file. Extract the contents of the zip file. It will be a .YML file. Then goto the automations tab and select "Upload automation":  

ABurt_0-1663062567140.png

 

It will import a new automation script that you can use for searching incidents and the incident errors.

 

Regards


Adam

I tried your automation is a really good idea, and I'll use it. However, "IncidentFailedTasks" is not only for failed task query, it's for any kind of query, similiar to "SearchIncidentsV2", no?

It uses the same search syntax as the Lucene query when provided as the "query" input. It will search all the incidents that match for any failed task in those incidents.

 

Regards


Adam

  • 1 accepted solution
  • 3304 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!