Assign Active Incidents to Next Shift V2

This playbook reassigns Active Incidents to the current users on call. It requires shift management to be set up. The playbook can be run as a job a few minutes after the scheduled shift change time. You can update the playbook input with a different search query, if required. Will branch if there are no incidents that match the query and no users on call. Cases will not be assigned to users that defined OOO (by OutOfOffice automation).

Shift Management · 9 tasks · 1 input · 0 outputs

Details

IDAssign Active Incidents to Next Shift V2
From Version6.0.0
Tasks9

README

This playbook reassigns active incidents to the current users on call. It requires shift management to be set up. The playbook can be run as a job a few minutes after the scheduled shift change time.

Update the playbook input with a different search query if required. Will branch if there are no incidents that match the query and no users on call.

Cases will not be assigned to users who defined OOO (by OutOfOffice automation).

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • SearchIncidentsV2
  • AssignToNextShiftOOO
  • SetGridField

Commands

  • getUsers

Playbook Inputs

Name Description Default Value Required
IncidentSearchQuery Query for the incidents to reassign. Incidents need to be active for this to work. It will not reassign pending incidents. -status:closed -category:job -type:”Shift handover” Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Assign Active Incidents to Next Shift V2

Inputs

  • IncidentSearchQuery — Query for the incidents to reassign. Incidents need to be active. It will not reassign pending incidents.

Commands used

getUsers

Flowchart

yes yes Start Start Search for Incidents - SearchIncidentsV2 Search for Incidents SearchIncidentsV2 Are there open incidents? Are there open incidents? Assign Incidents to next shift - AssignToNextShiftOOO Assign Incidents to next ... AssignToNextShiftOOO Get Users on Call - getUsers Get Users on Call getUsers Are there users on call? Are there users on call? Set open incidents to layout - SetGridField Set open incidents to la... SetGridField Done Done Search for Incidents - SearchIncidentsV2 Search for Incidents SearchIncidentsV2

Source

playbook-ShiftManagment_Assign_Active_Incidents_to_Next_Shift.yml
Download History Raw 
id: Assign Active Incidents to Next Shift V2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Assign Active Incidents to Next Shift V2
description: "This playbook reassigns Active Incidents to the current users on call.\
  \ It requires shift management to be set up.  The playbook can be run as a job a\
  \ few minutes after the scheduled shift change time.\n\nYou can update the playbook\
  \ input with a different search query, if required.  Will branch if there are no\
  \ incidents that match the query and no users on call. \n\nCases will not be assigned\
  \ to users that defined OOO (by OutOfOffice automation)."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 732379f6-9b8c-4117-8733-e0eb568cac60
    type: start
    task:
      id: 732379f6-9b8c-4117-8733-e0eb568cac60
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: a9a33550-08a7-47d8-86b4-88ff7ccb277a
    type: regular
    task:
      id: a9a33550-08a7-47d8-86b4-88ff7ccb277a
      version: -1
      name: Search for Incidents
      description: Searches Cortex XSOAR incidents.
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        simple: ${inputs.IncidentSearchQuery}
      reason: {}
      size: {}
      sort: {}
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 6aadb57e-7e9f-4f73-88ea-5076e7918d07
    type: condition
    task:
      id: 6aadb57e-7e9f-4f73-88ea-5076e7918d07
      version: -1
      name: Are there open incidents?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: foundIncidents
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: def4dada-8825-435d-8fdf-9e922185a27a
    type: regular
    task:
      id: def4dada-8825-435d-8fdf-9e922185a27a
      version: -1
      name: Assign Incidents to next shift
      description: |-
        Randomly assigns the incidents to users on call (requires shift management). This is an example automation for reassigning a large number of incidents to the next shift. This automation works with the  Out of Office automation to ensure only available users get assigned.

        See for more information:  
        [Cortex XSOAR 6.13](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Shift-Management)  
        [Cortex XSOAR 8 Cloud](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Manage-roles-in-the-Cortex-XSOAR-tenant)
        [Cortex XSOAR 8.7 On-prem](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Manage-roles-in-the-Cortex-XSOAR-tenant)

        Incident IDs should be passed in a comma-separated list.
      scriptName: AssignToNextShiftOOO
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      incidentIds:
        simple: ${foundIncidents.id}
      listname: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": 945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: c9aebe9c-0692-4f6c-8454-157709aa68b8
    type: regular
    task:
      id: c9aebe9c-0692-4f6c-8454-157709aa68b8
      version: -1
      name: Get Users on Call
      description: commands.local.cmd.get.users
      script: Builtin|||getUsers
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      current: {}
      incidentId: {}
      onCall:
        simple: "true"
      online: {}
      roles: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 360,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 0f9cafe2-9e5e-4409-8156-ba1f84dab7f3
    type: condition
    task:
      id: 0f9cafe2-9e5e-4409-8156-ba1f84dab7f3
      version: -1
      name: Are there users on call?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: DemistoUsers
                accessor: name
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: DemistoUsers
                accessor: name
            iscontext: true
    view: |-
      {
        "position": {
          "x": 360,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 9156d781-74e6-4d09-8b0f-f3bb1ccb25ed
    type: regular
    task:
      id: 9156d781-74e6-4d09-8b0f-f3bb1ccb25ed
      version: -1
      name: Set open incidents  to layout
      description: Creates a grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      columns:
        simple: Incident ID,Incident name,Incident owner,Link to incident
      context_path:
        simple: foundIncidents
      grid_id:
        simple: shiftopenincidents
      keys:
        simple: id,name,owner,incidentLink
      overwrite: {}
      sort_by: {}
      unpack_nested_elements: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": 1270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: d3591c44-abaa-462e-863c-910c353039a7
    type: title
    task:
      id: d3591c44-abaa-462e-863c-910c353039a7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 52cd9a7e-8163-4256-8796-fb31e70eb386
    type: regular
    task:
      id: 52cd9a7e-8163-4256-8796-fb31e70eb386
      version: -1
      name: Search for Incidents
      description: Searches Cortex XSOAR incidents.
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        simple: ${inputs.IncidentSearchQuery}
      reason: {}
      size: {}
      sort: {}
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "5_8_#default#": 0.21
    },
    "paper": {
      "dimensions": {
        "height": 1505,
        "width": 850,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: IncidentSearchQuery
  value:
    simple: 'status:active -category:job -type:"Shift handover" '
  required: false
  description: 'Query for the incidents to reassign. Incidents need to be active.
    It will not reassign pending incidents. '
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0