Sleep until 8.00AM the next day using SLA/timers

[KeremGunal]

Hello,

By using SLA/Timer on XSOAR, I want the playbook to wait until 08.00 the next day. how can I do that?

I can use the sleep function, but I want to do it in the most performant way. Do you have any other suggestions?

Thanks.

[gyldz]

Hi @KeremGunal , what do you mean by "wait"? Is it stopping SLA and starting at 8 am or stopping the playbook running if the hour is after business hours? If you define your need in detail, I can try to propose a workaround.

[KeremGunal]

Hello @gyldz, 

For example.
It's now 26.03.2024 11.05.
here I want to keep the wait task waiting until 08:00 the next day 27.03.2024.

At 08:00 it will continue the playbook.

I want to do this as a best practice in terms of performance.

[gyldz]

What is the condition to make the task wait at 11:05? Is it a specific task, on demand?

[KeremGunal]

For example,
I have a playbook that's supposed to run at 08:00 the next day.

Or secondly, I expect a response from a mail. After sending the mail, I give a response time of 24 hours + until 08:00 the next day. if there is no response, I want it to continue the playbook.

For example, I sent an e-mail on 26.03.2024 11:45. I will have a waiting period until 28.03.2024 08:00.

[gyldz]

Hi @KeremGunal ,

A playbook that's supposed to run at 08:00 the next day --> As a first task in the playbook, you can run !GetTime automation to get only Hours of the current time. If your condition is to check if it is within business hours, add a conditional task to check if !GetTime output is < 18. If yes, you will follow the regular playbook. If not put a manual task to make the playbook wait to be followed. Tag the manual task something like "waitingtask". Add a job which will query incidents in waiting status(incident.runStatus:waiting) and only extract the incident ids of the waiting incidents. As a second task which is a subplaybook, provide a list of incident ids and create a task under subplaybook with only !completeTask command. Provide the tag you defined in your main playbook as id ("waitingtask") and id of the incident in Waiting status. If you run this job every morning at 8, you can have a playbook waiting without consuming resources as Sleep task would.

For Data Collection, you can do something similar. Define a tag from the data collection task's Detail tab and run a job to complete the task with that tag at 8 am.

I hope this solves your problem.

[KeremGunal]

Hello,

First thing is ok, thanks.

But secondly,

This way I can only run the job at 8 o'clock and if the task is finished I can only forward it at 8 o'clock.
I need something like this there.
I give a waiting time until 8:00 am. If I get a response from the mail before 8:00 am, I want that playbook to forward. can I do this without using resources?