Create a section header - Administrator Guide - 8.5 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR On-prem Documentation

Product
Cortex XSOAR
Version
8.5
Creation date
2024-03-10
Last date published
2024-11-28
Category
Administrator Guide
Solution
On-prem
Abstract

Section header tasks are used to manage the flow of your playbook and help you organize your tasks efficiently.

Section headers are used to manage the flow of your playbook and help you organize your tasks efficiently. You create a section header to group a number of related tasks.

Section headers can also be used for time tracking between phases in a playbook. When you start time tracking, apply the Start action for the section header. Because you are using this to time track a particular phase of an investigation, add a stop timer section header when the phase completes. The time tracking data can be used to display in dashboards and report time trends.

  1. In a playbook, click + to create a task.

  2. Select the Section Header option.

  3. Enter a meaningful name in the Task Name field for the section header.

  4. Configure the relevant fields.

    Tab

    Fields in the tab

    Details

    Tag the result with: Add a tag to the task result. You can use the tag to filter entries in the War Room.

    Timers

    For a time tracking header, select the action to take when the timer is triggered (start, stop, or pause).

    • Timer.start: The trigger for starting to send a message or survey to recipients. You can change this trigger or add a trigger for Timer.stop or Timer.pause. Select the trigger timer field from the drop down.

    • Add Trigger: You can add other trigger timer fields from the drop down.

  5. Click Save.