Create a Time Triggered Job - Administrator Guide - 6.5 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.5
Creation date
2022-09-28
Last date published
2024-11-12
End_of_Life
EoL
Category
Administrator Guide
Abstract

Create a time triggered or feed triggered job in Cortex XSOAR to run a playbook.

Time triggered jobs run at predetermined times. You can schedule the job to run at a recurring time or one time at a specific date and time. For an example, see Add Indicators to SIEM Using a Time Triggered Job.

Note

To view a human readable description of a cron schedule for an existing job, change the table settings by clicking the settings icon and selecting Job Schedule from the available columns.

  1. Select JobsNew Job.

  2. Select Time triggered.

  3. If you want the job to repeat at regular intervals, select the Recurring checkbox and choose the desired interval.

    You can choose to run the job every X number of days, on specific days of the week, at a specific time and also choose a start date and an expiration date. You have the option to configure the recurring job using a cron expression. To do so, after selecting the Recurring checkbox, click Switch to Cron view and enter the expression. For assistance in defining the cron expression, click Show cron examples after switching to cron view.

  4. If you do not want to the job to repeat, Select date and time the job should run.

  5. Add or create any relevant tags to use as search parameter in the system.

  6. In the Basic information section, add the required Time Triggered Job Parameters.

  7. Enter any relevant custom fields parameters.

    All fields that have the Add to all incident types checkbox selected in incident and indicator fields, appear.

  8. In the Queue Handling section, select whether to notify the owner of the job if the job is triggered while a previous instance of the job is active.

    Note

    Notifications are only sent if a mail sender integration is configured. To test your mail integration, from the CLI, run !send-mail to=my-email@my-company.com subject=test body=test

  9. Select an option to use if the job is triggered while a previous instance of the job is active:

    • Don’t trigger a new job instance.

    • Cancel the previous job instance and trigger a new job instance.

    • Trigger a new job instance and run concurrently with the previous instance.

  10. Create new job.