Content Update Manager

This playbook checks for any available content updates for selected installed content packs and notifies users via e-mail or Slack. It also contains an auto-update flow that lets users decide via playbook inputs or communication tasks if they want to trigger an auto-update process to install all updates that were found. This playbook can be used as a Cortex XSOAR job to help users track marketplace pack updates and install them regularly.

XSOAR Content Update Notifications · 46 tasks · 7 inputs · 0 outputs

Inputs

  • notificationemail — Provides semi-colon delimited e-mail addresses for the new content notifications. Note: You must have an installed and configured integration that supports the send-mail command.
  • slackuser — Provides a Slack username for the new content notifications. Note: You must have an installed and configured Slack integration.
  • slackchannel — Provides a Slack channel for the new content notifications. Note: You must have an installed and configured Slack integration. Also, make sure the Cortex XSOAR application has access to this channel.
  • slackchannelid — Provides a Slack channel ID for the new content notifications. Note: You must have an installed and configured Slack integration.
  • packs — A CSV of packs to monitor.
  • auto_update — Establishes whether to automatically update the content packs if there are available updates or wait for an analyst's approval or the manual update process. Specify 'Yes' for auto-update or 'No' for manual update.
  • demisto_rest_api_name — Defines which instance of a configured Demisto API to use for checking updates against.

Commands used

closeInvestigation core-api-get send-mail send-notification setIncident

Flowchart

Send Emails Send Slack Channel Send Slack User yes yes yes No yes Send Slack channel update yes yes Send Slack User yes Send Emails Start Start Check for updates - core-api-get Check for updates core-api-get Close investigation - closeInvestigation Close investigation closeInvestigation Process Notifications Process Notifications Done Done Are there e-mail addresses? Are there e-mail addresses? Are there Slack channels? Are there Slack channels? Are there Slack users? Are there Slack users? Set closing information - no updates - setIncident Set closing information -... setIncident Close Investigation Close Investigation Send Slack notification and question to channel Send Slack notification a... Set closing information - finished update - setIncident Set closing information -... setIncident Get server URL - GetServerURL Get server URL GetServerURL Check For Content Installation - Check For Content Installation Check For Content Install... Check For Content Installation Are there relevant updates? Are there relevant updates? Set closing information - no updates - setIncident Set closing information -... setIncident Were the packs updated? Were the packs updated? Send Slack notification - send-notification Send Slack notification send-notification Were there any failed updates? Were there any failed upd... Is there a user filter? Is there a user filter? Add all updates to check list - Set Add all updates to check ... Set Add specific updates to check list - Set Add specific updates to c... Set Are there available updates? Are there available updates? Close Investigation Close Investigation Close Investigation Close Investigation Are there Slack channels? Are there Slack channels? Collect packs data - CollectPacksData Collect packs data CollectPacksData Should the playbook perform auto-update? Should the playbook perfo... Manual - Do you allow the playbook to perform auto-update? Manual - Do you allow the... Send Slack notification and question to user Send Slack notification a... Send E-mail notification and question Send E-mail notification ... Add available updates to layout - setIncident Add available updates to ... setIncident Send Slack notification Send Slack notification Are there Slack users? Are there Slack users? Send Slack notification - send-notification Send Slack notification send-notification Is the auto-update input set to "Yes"? Is the auto-update input ... Ask by survey Ask by survey Update packs Update packs Manually update content packs Manually update content p... Are there e-mail addresses? Are there e-mail addresses? Send Email notification - send-mail Send Email notification send-mail Set description to layout and set default pack selection - setIncident Set description to layout... setIncident Install updates for chosen packs - ContentPackInstaller Install updates for chose... ContentPackInstaller Save latest release notes - GetLatestReleaseNotes Save latest release notes GetLatestReleaseNotes Set successful update - SetAndHandleEmpty Set successful update SetAndHandleEmpty Manual - review failed update task Manual - review failed up...