Debugger Troubleshooting - Administrator Guide - 6.6 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.6
Creation date
2022-09-29
Last date published
2024-11-12
End_of_Life
EoL
Category
Administrator Guide
Abstract

Find and fix potential issues with the Cortex XSOAR Playbook Debugger.

Troubleshooting the Playbook Debugger:

User Permissions

The debugger runs with the permissions of the logged in user. The user must have permissions for both PlaybooksRW and InvestigationRW to run the debugger.

Debugger Worker Pool

The playbook debugger has a separate worker pool. If you have many users running debugger sessions at the same time, and there performance issues, you can increase the number of workers. To change the number of workers, go to SettingsAboutTroubleshootingServer Configuration and add the server configuration workers.count.Debug. The default number of workers is 1.

Terminate Debugger Sessions

By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes. You can change the frequency of the automatic terminations and also the length of time a debugger session can remain open. To change the default from 24 hours, go to SettingsAboutTroubleshootingServer Configuration and add the server configuration clean.playbook.debug.sessions.interval. The unit is hours.. To change the maximum time a debugger session can remain open, add the server configuration playbook.debug.sessions.duration.max. The unit is minutes.

The default admin can close either all debugger sessions or a specific user’s debugger sessions through the API.

  • To close all debugger sessions, send a POST request to the endpoint /debugsession/remove.

  • To close only the debugger sessions for a specific user, include the following request parameter in the body of the request {"username": "CHOSEN_USERNAME"}. Note that if no user is specified in the request, all open debugger sessions for all users will be terminated.