Configure a playbook to run timers - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Within a playbook, a timer can be set to start, pause, or stop at a specific section header or task. For example, you can create a timer called Pending user response and have it start in a playbook when an email is sent to a user. If the user does not respond within the target timeframe, then you can automatically send an additional reminder to the user or run a different task.

When selecting a timer in a task or section header, in the Timers tab, select the action that you want the timer to perform for the task. You can add multiple timers to a task or section header, so in the same task you can stop one timer and start another.

Some playbooks, such as Phishing - Generic v3, come out-of-the-box with timer tasks included. If you need the same timers across use cases, create a sub-playbook based on your use case or conditions such as alert severity.

If you want to stop or pause a timer in a playbook, you can use an existing task or create a new section header/task. When you select Timer.stop, the run is considered finished and cannot be restarted without setting it to zero. If you plan to restart the timer, select Timer.pause so you do not lose the accumulated time. By default, all timers stop when the incident closes.