I'd like to take the generic polling concept and make it a little more specific, but I'm coming up short. I'm doing a QRadar search (although I suspect Splunk or anything else would be very similar.) The QRadarFullSearch playbook will poll and wait for the search to finish, and that has worked great so far for what it is. But the search can finish while not actually finding anything. Can I somehow set some loops and polling to do the search, check for results, and then kick off a new search if no results were found? I would still like to use the timeout value so I'm not creating an infinite loop situation.
... View more