Configure a playbook to run timers - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Cortex XSIAM
Creation date
Last date published
Administrator Guide

Add or configure a playbook to run timers.

Within a playbook, a timer can be set to start, pause, or stop at a specific section header or task. For example, you can create a timer called Pending user response and have it start in a playbook when an email is sent to a user. If the user does not respond within the target timeframe, then you can automatically send an additional reminder to the user or run a different task.

When selecting a timer in a task or section header, in the Timers tab, select the action that you want the timer to perform for the task. You can add multiple timers to a task or section header, so in the same task you can stop one timer and start another.


When a task or section has a timer configured, it displays the hourglass icon.




Starts the timer.


Timers are not started automatically when an incident is created.


Pauses the timer. A paused timer can be started again without being reset.


Stops the timer. Information about the timer is still displayed in the alert layout and/or alerts table, but the status displays as Ended.


If you stop a timer before the alert is closed, you must reset the timer using the resetTimer command before you can start the timer again. When you reset the timer, all fields are cleared.

Some playbooks, such as Phishing - Generic v3, come out-of-the-box with timer tasks included. If you need the same timers across use cases, create a sub-playbook based on your use case or conditions such as alert severity.

If you want to stop or pause a timer in a playbook, you can use an existing task or create a new section header/task. When you select Timer.stop, the run is considered finished and cannot be restarted without setting it to zero. If you plan to restart the timer, select Timer.pause so you do not lose the accumulated time. By default, all timers stop when the incident closes.