Obtain Playbook Metadata - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
8
Creation date
2024-09-18
Last date published
2024-10-14
Category
Administrator Guide
Solution
Cloud
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation
Abstract

Analyze Cortex XSOAR playbook metadata for troubleshooting custom playbooks. Use the getInvPlaybookMetaData command.

You can analyze playbook metadata such as tasks input and output, the amount of storage each task input/output uses, and the type of task. This is useful when troubleshooting your custom playbook if your system has slowed down and there is high CPU usage, memory, or storage (disk space) issues.

After an incident has been assigned to a playbook you can analyze it to see the tasks inputs/outputs storage. You can filter the data according to the KB used in each task input/output.

  • Run the following command.

    !getInvPlaybookMetaData incidentId=<incident ID> minSize=<size of the data you want to return in KB. Default is 10>

    For example, to view the playbook metadata that is used in incident number 964, type !getInvPlaybookMetaData incidentid=”964” minSize=”0”. .