Troubleshoot playbook performance - Obtain playbook metadata to troubleshoot performance issues. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

You can analyze playbook metadata such as tasks input and output, the amount of storage each task input/output uses, and the type of task. This is useful when troubleshooting your custom playbook if your system has slowed down.

After an incident has been assigned to a playbook you can analyze it to see its tasks inputs/outputs storage. You can filter the data according to the KB used in each task input/output.

From the Incidents page, in the Incident War Room for a specific incident, run the following command in the CLI.

!getInvPlaybookMetaData incidentId=<incident ID> minSize=<size of the data you want to return in KB. Default is 10>