Content Update Check Deprecated Hidden
Deprecated. Use "Content Update Manager" playbook instead. This playbook will check to see if there are any content updates available for installed packs and notify users via e-mail or Slack.
XSOAR Content Update Notifications · 28 tasks · 4 inputs · 0 outputs
Details
| ID | Content Update Check |
|---|---|
| From Version | 6.0.0 |
| Tasks | 28 |
README
Deprecated. Use “Content Update Manager” playbook instead. This playbook will check to see if there are any content updates available for installed packs and notify users via e-mail or Slack.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Check For Content Installation
Integrations
- SlackV2
Scripts
- GetServerURL
- Set
Commands
- closeInvestigation
- send-notification
- setIncident
- send-mail
- core-api-get
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| notificationemail | Provide semi-colon delimited e-mail addresses that will be used for the new content notifications. You will require an integration installed and configured that supports the send-mail command. | incident.contentnotificationemail | Required |
| slackuser | Provide a Slack username to which the notifications will be sent to. You will require Slack integration to be installed and configured. | incident.contentnotificationslackusername | Optional |
| slackchannel | Provide a Slack channel to which the notifications will be sent to. You will require Slack integration to be installed and configured. Also, ensure that the XSOAR application has access to this channel. | incident.contentnotificationslackchannel | Optional |
| packs | A CSV of packs to monitor | incident.contentpackselection | Required |
Playbook Outputs
There are no outputs for this playbook.
Inputs
notificationemail— Provide semi-colon delimited e-mail addresses that will be used for the new content notifications. You will require an integration installed and configured that supports the send-mail command.slackuser— Provide a Slack username to which the notifications will be sent to. You will require Slack integration to be installed and configured.slackchannel— Provide a Slack channel to which the notifications will be sent to. You will require Slack integration to be installed and configured. Also, ensure that the XSOAR application has access to this channel.packs— A CSV of packs to monitor
Commands used
closeInvestigation
core-api-get
send-mail
send-notification
setIncident
Flowchart
contentitemexportablefields: contentitemfields: propagationLabels: - all description: Deprecated. Use "Content Update Manager" playbook instead. This playbook will check to see if there are any content updates available for installed packs and notify users via e-mail or Slack. id: Content Update Check inputs: - description: Provide semi-colon delimited e-mail addresses that will be used for the new content notifications. You will require an integration installed and configured that supports the send-mail command. key: notificationemail playbookInputQuery: required: true value: complex: accessor: contentnotificationemail root: incident - description: Provide a Slack username to which the notifications will be sent to. You will require Slack integration to be installed and configured. key: slackuser playbookInputQuery: required: false value: complex: accessor: contentnotificationslackusername root: incident - description: Provide a Slack channel to which the notifications will be sent to. You will require Slack integration to be installed and configured. Also, ensure that the XSOAR application has access to this channel. key: slackchannel playbookInputQuery: required: false value: complex: accessor: contentnotificationslackchannel root: incident - description: A CSV of packs to monitor key: packs playbookInputQuery: required: true value: complex: accessor: contentpackselection root: incident transformers: - args: delimiter: value: simple: ',' operator: split name: Content Update Check outputs: [] starttaskid: "0" tasks: "0": id: "0" ignoreworker: false nexttasks: '#none#': - "21" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: 2b52cce9-80aa-462a-8e47-688fd7dc3781 iscommand: false name: "" version: -1 description: '' taskid: 2b52cce9-80aa-462a-8e47-688fd7dc3781 timertriggers: [] type: start view: |- { "position": { "x": 817.5, "y": 50 } } "1": id: "1" ignoreworker: false nexttasks: '#none#': - "36" note: false quietmode: 0 scriptarguments: extend-context: simple: ContentPreData=response(val.updateAvailable==true) uri: simple: /contentpacks/installed-expired separatecontext: false skipunavailable: false task: brand: "" description: send HTTP GET requests id: 76a92f34-11f1-449d-80c4-e95bdff94024 iscommand: true name: Check for updates script: '|||core-api-get' type: regular version: -1 taskid: 76a92f34-11f1-449d-80c4-e95bdff94024 timertriggers: [] type: regular view: |- { "position": { "x": 817.5, "y": 370 } } "5": id: "5" ignoreworker: false nexttasks: '#none#': - "9" note: false quietmode: 0 scriptarguments: closeNotes: simple: ${incident.closeNotes} closeReason: simple: ${incident.closeReason} separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.close.inv id: d3f63352-9655-4b9b-82b4-1a1252305191 iscommand: true name: Close case script: Builtin|||closeInvestigation type: regular version: -1 taskid: d3f63352-9655-4b9b-82b4-1a1252305191 timertriggers: [] type: regular view: |- { "position": { "x": 817.5, "y": 2780 } } "6": id: "6" ignoreworker: false nexttasks: '#none#': - "10" - "12" - "13" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: f8cfa9e6-d368-47be-8a6b-fdfe6d05495e iscommand: false name: Process Notifications type: title version: -1 description: '' taskid: f8cfa9e6-d368-47be-8a6b-fdfe6d05495e timertriggers: [] type: title view: |- { "position": { "x": 817.5, "y": 1245 } } "9": id: "9" ignoreworker: false note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: 5d7eff6f-7d76-49a8-8ecd-d59cd1c35227 iscommand: false name: Done type: title version: -1 description: '' taskid: 5d7eff6f-7d76-49a8-8ecd-d59cd1c35227 timertriggers: [] type: title view: |- { "position": { "x": 817.5, "y": 2935 } } "10": conditions: - condition: - - left: iscontext: true value: complex: filters: - - left: iscontext: true value: simple: modules.commands.name operator: isEqualString right: value: simple: send-mail - - left: iscontext: true value: simple: modules.state operator: isEqualString right: value: simple: active root: modules operator: isNotEmpty - - left: iscontext: true value: complex: accessor: contentnotificationemail root: incident operator: isNotEmpty label: Send Emails id: "10" ignoreworker: false nexttasks: '#default#': - "23" Send Emails: - "11" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" description: This will check if e-mail addresses have been provided and that there are "send-mail" compatible integrations that are enabled. id: 1ae3bd65-646f-4d0b-8a98-67c599b73085 iscommand: false name: Emails type: condition version: -1 taskid: 1ae3bd65-646f-4d0b-8a98-67c599b73085 timertriggers: [] type: condition view: |- { "position": { "x": 285, "y": 1390 } } "11": continueonerror: true id: "11" ignoreworker: false nexttasks: '#none#': - "23" note: false quietmode: 0 scriptarguments: body: complex: root: ContentData transformers: - args: field: value: simple: name operator: getField - args: prefix: value: simple: '- ' suffix: {} operator: concat - args: separator: value: simple: |2+ operator: join - args: prefix: value: simple: |+ There are content updates available for XSOAR: suffix: {} operator: concat - args: prefix: {} suffix: value: simple: "\nYou can view them here: " operator: concat - args: prefix: {} suffix: iscontext: true value: simple: ServerURL.URL operator: concat - args: prefix: {} suffix: value: simple: /#/market/installed operator: concat subject: simple: New content updates available for XSOAR to: complex: accessor: contentnotificationemail root: incident separatecontext: false skipunavailable: false task: brand: "" description: Send an email id: 231ddd44-4364-4524-8721-7c5a0a6447d0 iscommand: true name: Send E-mail script: '|||send-mail' type: regular version: -1 taskid: 231ddd44-4364-4524-8721-7c5a0a6447d0 timertriggers: [] type: regular view: |- { "position": { "x": 397.5, "y": 1565 } } "12": conditions: - condition: - - left: iscontext: true value: complex: filters: - - left: iscontext: true value: simple: modules.brand operator: isEqualString right: value: simple: SlackV2 - - left: iscontext: true value: simple: modules.state operator: isEqualString right: value: simple: active root: modules operator: isNotEmpty - - left: iscontext: true value: complex: accessor: contentnotificationslackchannel root: incident operator: isNotEmpty label: Send Slack Channel id: "12" ignoreworker: false nexttasks: '#default#': - "23" Send Slack Channel: - "18" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" description: This task will check if any Slack integrations are configured and whether a Slack channel has been provided in the inputs. id: d401a9b9-cc39-4485-8ed9-93f4aaaac611 iscommand: false name: Slack Channel type: condition version: -1 taskid: d401a9b9-cc39-4485-8ed9-93f4aaaac611 timertriggers: [] type: condition view: |- { "position": { "x": 817.5, "y": 1390 } } "13": conditions: - condition: - - left: iscontext: true value: complex: filters: - - left: iscontext: true value: simple: modules.brand operator: isEqualString right: value: simple: SlackV2 - - left: iscontext: true value: simple: modules.state operator: isEqualString right: value: simple: active root: modules operator: isNotEmpty - - left: iscontext: true value: complex: accessor: contentnotificationslackusername root: incident operator: isNotEmpty label: Send Slack User id: "13" ignoreworker: false nexttasks: '#default#': - "23" Send Slack User: - "22" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" description: This task will check if any Slack integrations are configured and whether a Slack username has been provided in the inputs. id: 23769514-fc90-41d2-843a-f6b29c0ffd17 iscommand: false name: Slack User type: condition version: -1 taskid: 23769514-fc90-41d2-843a-f6b29c0ffd17 timertriggers: [] type: condition view: |- { "position": { "x": 1267.5, "y": 1390 } } "16": id: "16" ignoreworker: false nexttasks: '#none#': - "17" note: false quietmode: 0 scriptarguments: closeNotes: simple: No updates available closeReason: simple: Resolved separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.set.incident id: c4f1ce28-6877-4fd5-86a9-98722ad7100f iscommand: true name: Set Close Reason script: Builtin|||setIncident type: regular version: -1 taskid: c4f1ce28-6877-4fd5-86a9-98722ad7100f timertriggers: [] type: regular view: |- { "position": { "x": 1605, "y": 2440 } } "17": id: "17" ignoreworker: false nexttasks: '#none#': - "5" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: 6b0bf3bb-8a25-431c-8507-9621369ee9a2 iscommand: false name: Close Case type: title version: -1 description: '' taskid: 6b0bf3bb-8a25-431c-8507-9621369ee9a2 timertriggers: [] type: title view: |- { "position": { "x": 817.5, "y": 2635 } } "18": continueonerror: true id: "18" ignoreworker: false nexttasks: '#none#': - "23" note: false quietmode: 0 scriptarguments: channel: complex: accessor: contentnotificationslackchannel root: incident ignoreAddURL: simple: "true" message: complex: root: ContentData transformers: - args: field: value: simple: name operator: getField - args: prefix: value: simple: '*- ' suffix: value: simple: '*' operator: concat - args: separator: value: simple: |2+ operator: join - args: prefix: value: simple: |+ There are content updates available for XSOAR: suffix: value: simple: |2 View them here: operator: concat - args: prefix: {} suffix: iscontext: true value: simple: ServerURL.URL operator: concat - args: prefix: {} suffix: value: simple: /#/market/installed operator: concat separatecontext: false skipunavailable: false task: brand: "" description: Sends a message to a user, group, or channel. id: e4ee362f-266a-4443-854f-7a3b067ffcfd iscommand: true name: Send Slack Notification to Channel script: '|||send-notification' type: regular version: -1 taskid: e4ee362f-266a-4443-854f-7a3b067ffcfd timertriggers: [] type: regular view: |- { "position": { "x": 930, "y": 1565 } } "19": id: "19" ignoreworker: false nexttasks: '#none#': - "17" note: false quietmode: 0 scriptarguments: closeNotes: simple: All packs were updated closeReason: simple: Resolved separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.set.incident id: 0d68ac48-835d-4735-81a3-07ea252bc5ee iscommand: true name: Set Close Reason script: Builtin|||setIncident type: regular version: -1 taskid: 0d68ac48-835d-4735-81a3-07ea252bc5ee timertriggers: [] type: regular view: |- { "position": { "x": 1165, "y": 2440 } } "21": id: "21" ignoreworker: false nexttasks: '#none#': - "1" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" description: Get the Server URL. id: 91c2630c-5621-49b6-8cfb-73a439ad6171 iscommand: false name: Get Server URL scriptName: GetServerURL type: regular version: -1 taskid: 91c2630c-5621-49b6-8cfb-73a439ad6171 timertriggers: [] type: regular view: |- { "position": { "x": 817.5, "y": 195 } } "22": continueonerror: true id: "22" ignoreworker: false nexttasks: '#none#': - "23" note: false quietmode: 0 scriptarguments: ignoreAddURL: simple: "true" message: complex: root: ContentData transformers: - args: field: value: simple: name operator: getField - args: prefix: value: simple: '*- ' suffix: value: simple: '*' operator: concat - args: separator: value: simple: |2+ operator: join - args: prefix: value: simple: |+ There are content updates available for XSOAR: suffix: value: simple: |2 View them here: operator: concat - args: prefix: {} suffix: iscontext: true value: simple: ServerURL.URL operator: concat - args: prefix: {} suffix: value: simple: /#/market/installed operator: concat to: simple: ${incident.contentnotificationslackusername} separatecontext: false skipunavailable: false task: brand: "" description: Sends a message to a user, group, or channel. id: 569572f3-5306-45e4-8323-f68dd071768e iscommand: true name: Send Slack Notification to User script: '|||send-notification' type: regular version: -1 taskid: 569572f3-5306-45e4-8323-f68dd071768e timertriggers: [] type: regular view: |- { "position": { "x": 1380, "y": 1565 } } "23": id: "23" ignoreworker: false loop: builtincondition: - - left: iscontext: true value: simple: PacksUpdated operator: isTrue exitCondition: "" iscommand: false max: 720 wait: 120 nexttasks: '#none#': - "26" note: false quietmode: 0 separatecontext: true skipunavailable: false task: brand: "" description: This playbook checks for content updates. id: ffb3feaa-6347-4d8d-8cd9-65dba4152d51 iscommand: false name: Check For Content Installation playbookId: Check For Content Installation type: playbook version: -1 taskid: ffb3feaa-6347-4d8d-8cd9-65dba4152d51 timertriggers: [] type: playbook view: |- { "position": { "x": 817.5, "y": 1740 } } "24": conditions: - condition: - - left: iscontext: true value: complex: root: ContentData operator: isNotEmpty label: "yes" id: "24" ignoreworker: false nexttasks: '#default#': - "38" "yes": - "6" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" description: This task checks to see if there are any relevant updates available. It will include all updates as relevant if the user has selected "All" packs to be monitored. id: ae99952a-402d-45f2-8544-3ed9f2085ecb iscommand: false name: Are there relevant updates? type: condition version: -1 taskid: ae99952a-402d-45f2-8544-3ed9f2085ecb timertriggers: [] type: condition view: |- { "position": { "x": 377.5, "y": 1070 } } "25": id: "25" ignoreworker: false nexttasks: '#none#': - "17" note: false quietmode: 0 scriptarguments: closeNotes: complex: accessor: contentpackselection root: incident transformers: - args: separator: value: simple: ', ' operator: join - args: prefix: value: simple: Updates available but they do not match the user filter ( suffix: value: simple: ) operator: concat closeReason: simple: Resolved separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.set.incident id: bfb3277c-2b3c-4a53-8cd7-21fae1c4dd70 iscommand: true name: Set Close Reason script: Builtin|||setIncident type: regular version: -1 taskid: bfb3277c-2b3c-4a53-8cd7-21fae1c4dd70 timertriggers: [] type: regular view: |- { "position": { "x": 50, "y": 2440 } } "26": conditions: - condition: - - left: iscontext: true value: simple: PacksUpdated operator: isTrue label: "yes" id: "26" ignoreworker: false nexttasks: '#default#': - "30" "yes": - "39" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" description: This checks whether the packs were updated after either the sub-playbook has timed out or there are no more updates to be applied. It will result in the "yes" branch if the updates installed match those that were selected in the Content Packs to be monitored. id: 35d060bc-206c-472a-82df-6d49d9b46797 iscommand: false name: Were the packs updated? type: condition version: -1 taskid: 35d060bc-206c-472a-82df-6d49d9b46797 timertriggers: [] type: condition view: |- { "position": { "x": 817.5, "y": 1915 } } "29": continueonerror: true id: "29" ignoreworker: false nexttasks: '#none#': - "19" note: false quietmode: 0 scriptarguments: channel: complex: accessor: contentnotificationslackchannel root: incident ignoreAddURL: simple: "true" message: simple: All packs were updated! threadID: simple: ${Slack.Thread.ID} separatecontext: false skipunavailable: false task: brand: SlackV2 description: Sends a message to a user, group, or channel. id: af8d4071-f14c-4cc4-8463-4a6de49556b9 iscommand: true name: Send Slack Notification script: '|||send-notification' type: regular version: -1 taskid: af8d4071-f14c-4cc4-8463-4a6de49556b9 timertriggers: [] type: regular view: |- { "position": { "x": 1280, "y": 2270 } } "30": id: "30" ignoreworker: false nexttasks: '#none#': - "17" note: false quietmode: 0 scriptarguments: closeNotes: simple: Timeout reached for updating packs - auto-closing closeReason: simple: Resolved separatecontext: false skipunavailable: false task: brand: Builtin description: commands.local.cmd.set.incident id: 9a251b74-05a1-4286-814f-f3aed15ff99b iscommand: true name: Set Close Reason script: Builtin|||setIncident type: regular version: -1 taskid: 9a251b74-05a1-4286-814f-f3aed15ff99b timertriggers: [] type: regular view: |- { "position": { "x": 480, "y": 2440 } } "31": conditions: - condition: - - left: iscontext: false value: simple: All operator: in right: iscontext: true value: simple: incident.contentpackselection label: "no" id: "31" ignoreworker: false nexttasks: '#default#': - "35" "no": - "33" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" description: This will check whether the user has provided a specific content pack update filter other than "All" id: 77cbffc5-59fc-4834-8c8f-01dbd8707f66 iscommand: false name: Is there a user filter? type: condition version: -1 taskid: 77cbffc5-59fc-4834-8c8f-01dbd8707f66 timertriggers: [] type: condition view: |- { "position": { "x": 377.5, "y": 720 } } "33": continueonerror: true fieldMapping: - incidentfield: Content Updates Available output: complex: root: ContentData transformers: - operator: Stringify - args: separator: value: simple: ',' operator: join - args: prefix: value: simple: '[' suffix: value: simple: ']' operator: concat - operator: 6b3c5e6d-4da6-44bc-8c19-f3608b077e72 id: "33" ignoreworker: false nexttasks: '#none#': - "24" note: false quietmode: 0 scriptarguments: append: simple: "false" key: simple: ContentData value: complex: root: ContentPreData separatecontext: false skipunavailable: false task: brand: "" description: Set a value in context under the key you entered. id: 4ff1bda5-7941-4ecf-86fe-94107c9e4d95 iscommand: false name: Add all updates to check list scriptName: Set type: regular version: -1 taskid: 4ff1bda5-7941-4ecf-86fe-94107c9e4d95 timertriggers: [] type: regular view: |- { "position": { "x": 580, "y": 895 } } "35": continueonerror: true fieldMapping: - incidentfield: Content Updates Available output: complex: root: ContentData transformers: - operator: Stringify - args: separator: value: simple: ',' operator: join - args: prefix: value: simple: '[' suffix: value: simple: ']' operator: concat - operator: 6b3c5e6d-4da6-44bc-8c19-f3608b077e72 id: "35" ignoreworker: false nexttasks: '#none#': - "24" note: false quietmode: 0 scriptarguments: append: simple: "false" key: simple: ContentData value: complex: filters: - - left: iscontext: true value: simple: ContentPreData.name operator: in right: iscontext: true value: simple: inputs.packs root: ContentPreData separatecontext: false skipunavailable: false task: brand: "" description: Set a value in context under the key you entered. id: 85e35cb2-b585-4e5e-8ed7-5198bf855b42 iscommand: false name: Add specific updates to check list scriptName: Set type: regular version: -1 taskid: 85e35cb2-b585-4e5e-8ed7-5198bf855b42 timertriggers: [] type: regular view: |- { "position": { "x": 162.5, "y": 895 } } "36": conditions: - condition: - - left: iscontext: true value: simple: ContentPreData operator: isNotEmpty label: "yes" id: "36" ignoreworker: false nexttasks: '#default#': - "37" "yes": - "31" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" description: This will check if there are ANY updates at all available. id: 1338971b-7433-4c02-83e3-75b8ee776039 iscommand: false name: Are there updates available? type: condition version: -1 taskid: 1338971b-7433-4c02-83e3-75b8ee776039 timertriggers: [] type: condition view: |- { "position": { "x": 817.5, "y": 545 } } "37": id: "37" ignoreworker: false nexttasks: '#none#': - "16" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: c785da8e-5574-4b15-85e2-07d758be702a iscommand: false name: Close the case type: title version: -1 description: '' taskid: c785da8e-5574-4b15-85e2-07d758be702a timertriggers: [] type: title view: |- { "position": { "x": 1605, "y": 720 } } "38": id: "38" ignoreworker: false nexttasks: '#none#': - "25" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" id: 09b422ed-af78-45ec-812f-8a91f3d2c4c3 iscommand: false name: Close the case type: title version: -1 description: '' taskid: 09b422ed-af78-45ec-812f-8a91f3d2c4c3 timertriggers: [] type: title view: |- { "position": { "x": 50, "y": 1245 } } "39": conditions: - condition: - - left: iscontext: true value: complex: filters: - - left: iscontext: true value: simple: modules.brand operator: isEqualString right: value: simple: SlackV2 - - left: iscontext: true value: simple: modules.state operator: isEqualString right: value: simple: active root: modules operator: isNotEmpty - - left: iscontext: true value: complex: accessor: contentnotificationslackchannel root: incident operator: isNotEmpty label: Send Slack channel update id: "39" ignoreworker: false nexttasks: '#default#': - "19" Send Slack channel update: - "29" note: false quietmode: 0 separatecontext: false skipunavailable: false task: brand: "" description: This task will check if any Slack integrations are configured and whether a Slack channel has been provided in the inputs. id: 3070987b-f741-4911-85fd-49deb75a4f00 iscommand: false name: Send Slack notification if channel exists type: condition version: -1 taskid: 3070987b-f741-4911-85fd-49deb75a4f00 timertriggers: [] type: condition view: |- { "position": { "x": 1180, "y": 2100 } } version: -1 view: |- { "linkLabelsPosition": { "26_39_yes": 0.9 }, "paper": { "dimensions": { "height": 2950, "width": 1935, "x": 50, "y": 50 } } } hidden: true deprecated: true tests: - No tests (auto formatted) fromversion: 6.0.0