Sleep until 8.00AM the next day using SLA/timers

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Sleep until 8.00AM the next day using SLA/timers

L1 Bithead

Hello,

 

By using SLA/Timer on XSOAR, I want the playbook to wait until 08.00 the next day. how can I do that?

I can use the sleep function, but I want to do it in the most performant way. Do you have any other suggestions?

 

Thanks.

6 REPLIES 6

L4 Transporter

Hi @KeremGunal , what do you mean by "wait"? Is it stopping SLA and starting at 8 am or stopping the playbook running if the hour is after business hours? If you define your need in detail, I can try to propose a workaround.

 

 

L1 Bithead

Hello @gyldz

For example.
It's now 26.03.2024 11.05.
here I want to keep the wait task waiting until 08:00 the next day 27.03.2024.

At 08:00 it will continue the playbook.

I want to do this as a best practice in terms of performance.

L4 Transporter

What is the condition to make the task wait at 11:05? Is it a specific task, on demand?

L1 Bithead

For example,
I have a playbook that's supposed to run at 08:00 the next day.

 

Or secondly, I expect a response from a mail. After sending the mail, I give a response time of 24 hours + until 08:00 the next day. if there is no response, I want it to continue the playbook.

For example, I sent an e-mail on 26.03.2024 11:45. I will have a waiting period until 28.03.2024 08:00.

 
A playbook that's supposed to run at 08:00 the next day --> As a first task in the playbook, you can run !GetTime automation to get only Hours of the current time. If your condition is to check if it is within business hours, add a conditional task to check if !GetTime output is < 18. If yes, you will follow the regular playbook. If not put a manual task to make the playbook wait to be followed. Tag the manual task something like "waitingtask". Add a job which will query incidents in waiting status(incident.runStatus:waiting) and only extract the incident ids of the waiting incidents. As a second task which is a subplaybook, provide a list of incident ids and create a task under subplaybook with only !completeTask command. Provide the tag you defined in your main playbook as id ("waitingtask") and id of the incident in Waiting status. If you run this job every morning at 8, you can have a playbook waiting without consuming resources as Sleep task would.


For Data Collection, you can do something similar. Define a tag from the data collection task's Detail tab and run a job to complete the task with that tag at 8 am.

I hope this solves your problem.

Hello,

 

First thing is ok, thanks.

But secondly,

This way I can only run the job at 8 o'clock and if the task is finished I can only forward it at 8 o'clock.
I need something like this there.
I give a waiting time until 8:00 am. If I get a response from the mail before 8:00 am, I want that playbook to forward. can I do this without using resources?

  • 1533 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!