Playbook Task Fields - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Default assignee

Assign an owner to this task.

Only the assignee can complete the task

Stop the playbook from proceeding until the task assignee completes the task. By default, in addition to the task assignee, the default administrator can also complete the blocked task. You can also block tasks until a user with an external email address completes the task.

Task SLA

Define the deadline for the task, in weeks, days, hours, or minutes.

Set task reminder

Define a reminder for the task, in weeks, days, hours, or minutes.

Using

Determine which integration instance processes the script you select for this task.

Extend context

Determine which information from the raw JSON you want to add to the context data. This must be entered as contextKey=RawJsonOutputPath.

Ignore outputs

When selected, this takes the results from the extend context field and overwrites existing output.

Execution timeout (seconds)

Define how long a command waits, in seconds, before it times out.

Indicator Extraction mode

Determines whether to extract indicators from this task, and if so, by which method. Valid values are:

Mark results as note

Select to make the task results available as a note. Notes are viewable in the War Room.

Mark results as evidence

Select to make the task results available as evidence. Evidence is viewable in the War Room.

Run without a worker

Select to execute this task without requiring a worker. When cleared, this task will only execute when there is a worker available.

Skip this branch if this script/playbook is unavailable

Select to skip the branch of the playbook if the script or playbook selected is not available.

Quiet Mode

Determine if this task operates in Quiet Mode. When in Quiet Mode, tasks do not display inputs and outputs, nor do they extract indicators. Errors and Warnings are still documented. You can turn Quiet Mode on or off for a given task or control Quiet Mode at the playbook level.

Tag the result with

Add a tag to the task result. You can use the tag to filter entries in the War Room.

Task Description

Provide a description of what this task achieves.

You can enter objects from the context data in the description. For example, in a communication task, you can use the recipient’s email address.

The value for the object is based on what appears in the context every time the task runs.

Timer action

Determine which action to take when the timer is triggered. Valid values are: Start, Stop, and Pause.

Select timer field

Select the field on which the timer is applied.

Add Trigger

Select this to add another timer field on which the timer is applied.

Number of retries

Determines how many times the script attempts to run before generating an error. Default is 0 times (no tries).

Retry interval (seconds)

Determines the wait time (in seconds) between each execution of the script. Default is 30 seconds.

Error handling

Determines how a playbook task behaves if there are script errors during execution.

Ask by

The method for sending the message and survey.

Task: (default) users can complete the survey from the Work Plan.

Generated Link: a link to the survey appears in the Context Data.

Email: users are sent an email with a link to the survey.

If you have integrations that support messaging through other programs (such as Microsoft Teams or Slack), these will be listed here.

To

The message and survey recipients. There are several ways to define the recipients.

User role: Click inside the field to select a user role. All users assigned to the role will receive the message and survey.

Email address: Manually type email addresses for Cortex XSOAR users and/or external users.

Context: Click the context icon to define recipients from context data.

CC

The recipients of a copy of the message and survey. There are several ways to define the recipients.

User role: Click inside the field to select a user role. All users assigned to the role will receive the message and survey.

Email address: Manually type email addresses for Cortex XSOAR users and/or external users.

Context: Click the context icon to define recipients from context data.

Subject

The message subject that displays to message recipients. You can make the survey question the subject, but if you don't write the question here, you should write the question in the message body field.

Message/Message body

The text that displays in the body of the message. Although this field is optional, if you don't write the survey question in the Subject field, you should include it in the message body. This is a long text field.

Reply Options

The answers that display in the message, which users can select directly from the message.

Retry interval (minutes)

Determine the wait time between each execution of a command. For example, the frequency (in minutes) that a message and survey are resent to recipients before the response is received.

Number of retries

Determine how many times a command attempts to run before generating an error. For example, the maximum number of times a message is sent. If a reply is received, no additional retry messages will be sent.

Task SLA

Define the deadline for the task, in weeks, days, or hours.

Set task reminder

The schedule, in weeks, days, or hours, to resend the message and survey to recipients before.

Complete and expire automatically if (Data Collection task)

Choose to configure either of the following options, so that either one will trigger a stop to the playbook:

Complete automatically if SLA passed without a reply (Ask task)

Select this checkbox to complete the task if the SLA is breached before a reply is received. You can select yes or no.

Web Survey Title

The title of the web survey.

Short Description

A short description that displays above the questions in the web survey.

Question

A question to ask recipients.

Answer Type

The field type for the answer field. Valid values are:

Mandatory

If this checkbox is selected for a question, survey recipients are not able to submit the survey until they answer this question.

Help Message

The message that displays when users hover over the question mark help button for the survey question.

Placeholder

The empty value text that displays in the question's answer field.

Question

The question that displays before the field for users to complete. This field doesn't necessarily need to be a question, it can also be a descriptive sentence explaining how users should complete the field.

Field associated with this question

The field associated with the question will automatically take all the parameters from the field definition, unless otherwise defined.

Mandatory

If this checkbox is selected for a question, survey recipients will not be able to submit the survey until they answer this question.

Help Message

The message that displays when users hover over the question mark help button for the survey question.