Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Using "GetFailedTasks" with a relative time range of 7 or 30 days lookback

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Using "GetFailedTasks" with a relative time range of 7 or 30 days lookback

L3 Networker

Hello all,

I am working with the task 'GetFailedTasks' withing the Integrations & Incidents Health Check playbook. When running this task within this system playbook I am only getting failed tasks from the beginning of the year and this is likely due to the Max_incidents flag for this task. How would I go about adding to the query a relative time-frame of 7 or 30 days so that I can view and analyze only recent failing tasks? 

I have checked on another XSOAR deployment and the Playbook retrieves only recent incidents. Is this a bug or this is something that can be changed ?

Take note, I have upgraded the content pack to the latest versions and can confirm that the playbook remains attached. 

Many thanks

Cortex XSOAR 

1 REPLY 1

L3 Networker

@michaelsysec242

 

The GetFailedTasks command takes in as argument a query, which you can edit to include a timeframe of interest. For example, if you'd like to get the failed tasks within the last 7 days, you can edit the query parameter and use:

-status:closed and runStatus:error and incident.created:>="7 days ago"

 

If you're using the Out of the Box playbook "Integrations and Incidents Health Check - Running Scripts", you will need to duplicate it or detach it as it is locked, in order to change the query in the task. 



  • 671 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!