Jobs

You can create scheduled events in Cortex XSOAR using jobs. Jobs are triggered either by time-triggered events or feed-triggered events. For example, you can define a feed-triggered job to trigger a playbook when a specified TIM feed finishes a fetch operation for new indicators. Or you can schedule a time-triggered job that runs nightly and removes expired indicators.

For a better understanding of how jobs are implemented to trigger playbooks, read the tutorial for adding indicators to a SIEM.

Create a Job

  1. Navigate to Jobs.

  2. Click New Job.

  3. Determine if the job is time-triggered or feed-triggered.

    • Time-triggered jobs run at pre-determined times. You can schedule the job to run at a recurring time or one time at a specific time or date.
    • Feed-triggered jobs run when a feed has completed an operation. For example, a TIM feed has finished ingesting new indicators.

Time-triggered Jobs

  1. To configure the job to recur, select Recurring.
    Determine at which intervals the job recurs, when it starts, and when the job expires. You can also configure the recurring job using a cron expresion. To do so, click Switch to Cron view and enter the expression. For assistance in defining the cron expression, click Show cron examples.
    To configure the job to run once, enter a date and time in the Start at field.

Time-triggered Job

  1. Enter the information in the job configuration fields. Explanations of the job configuration fields are available below under Job Fields Reference.

  2. Configure how the job behaves when a previous of the instance of the job is already running.

    1. Under Queue Handling, select Notify the owner to inform the user listed under the Owner field that an instance of the job is already running.

    2. Determine the job behavior:

      • Don't trigger a new job instance - the current job continues to run and a new job is not triggered.

      • Cancel the previous job instance and trigger a new job instance - the current job that is running is cancelled and new job is triggered.

      • Trigger a new job instance and run concurrently with the previous instance - the current job continues to run and a new job is triggred in parallel.

    Time-triggered Queue Handling

  3. Click Create new job.

Feed-triggered Jobs

  1. Determine if the job is triggered when any feed has completed its operation or only when a specific feed(s) has completed its operation.

  2. Enter a meaningful name for the job.

  3. Select the playbook that runs when this job is triggered.

  4. Add tags to apply to the job. You can use these tags as a search parameter in the system.

  5. Click Create new job.

Feed-triggered Job

Job Fields Reference

The following table lists the fields available when defining a job, and their descriptions.

NameDescription
RecurringDetermine if the job is triggered at a pre-determined time interval.
TagsAdd tags to apply to the job. You can use these tags as a search parameter in the system.
NameEnter a meaningful name for the job.
OwnerAssign an owner to the incident.
RoleSelect the role who can access the incident.
TypeDetermine the incident type created by this job.
SeverityDetermine the severity of the incident that is created.
PlaybookDetermine which playbook to run when this job is triggered.
LabelsSelect the labels that are available in the incident type.
PhaseSelect the phase of the investigation in which this incident is opened.
DetailsEnter details that should appear within the incident.
AttachmentsClick the clip to add attachments to the job.
Notify the ownerSends a message to the job owner using one of the notification methods configured in Cortex XSOAR.
Last updated on