id: Assign Active Incidents to Next Shift V2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Assign Active Incidents to Next Shift V2
description: "This playbook reassigns Active Incidents to the current users on call.\
  \ It requires shift management to be set up.  The playbook can be run as a job a\
  \ few minutes after the scheduled shift change time.\n\nYou can update the playbook\
  \ input with a different search query, if required.  Will branch if there are no\
  \ incidents that match the query and no users on call. \n\nCases will not be assigned\
  \ to users that defined OOO (by OutOfOffice automation)."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 732379f6-9b8c-4117-8733-e0eb568cac60
    type: start
    task:
      id: 732379f6-9b8c-4117-8733-e0eb568cac60
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: a9a33550-08a7-47d8-86b4-88ff7ccb277a
    type: regular
    task:
      id: a9a33550-08a7-47d8-86b4-88ff7ccb277a
      version: -1
      name: Search for Incidents
      description: Searches Cortex XSOAR incidents.
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        simple: ${inputs.IncidentSearchQuery}
      reason: {}
      size: {}
      sort: {}
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 6aadb57e-7e9f-4f73-88ea-5076e7918d07
    type: condition
    task:
      id: 6aadb57e-7e9f-4f73-88ea-5076e7918d07
      version: -1
      name: Are there open incidents?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: foundIncidents
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: def4dada-8825-435d-8fdf-9e922185a27a
    type: regular
    task:
      id: def4dada-8825-435d-8fdf-9e922185a27a
      version: -1
      name: Assign Incidents to next shift
      description: |-
        Randomly assigns the incidents to users on call (requires shift management). This is an example automation for reassigning a large number of incidents to the next shift. This automation works with the  Out of Office automation to ensure only available users get assigned.

        See for more information:  
        [Cortex XSOAR 6.13](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Shift-Management)  
        [Cortex XSOAR 8 Cloud](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Manage-roles-in-the-Cortex-XSOAR-tenant)
        [Cortex XSOAR 8.7 On-prem](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Manage-roles-in-the-Cortex-XSOAR-tenant)

        Incident IDs should be passed in a comma-separated list.
      scriptName: AssignToNextShiftOOO
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      incidentIds:
        simple: ${foundIncidents.id}
      listname: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": 945
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: c9aebe9c-0692-4f6c-8454-157709aa68b8
    type: regular
    task:
      id: c9aebe9c-0692-4f6c-8454-157709aa68b8
      version: -1
      name: Get Users on Call
      description: commands.local.cmd.get.users
      script: Builtin|||getUsers
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      current: {}
      incidentId: {}
      onCall:
        simple: "true"
      online: {}
      roles: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 360,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 0f9cafe2-9e5e-4409-8156-ba1f84dab7f3
    type: condition
    task:
      id: 0f9cafe2-9e5e-4409-8156-ba1f84dab7f3
      version: -1
      name: Are there users on call?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: DemistoUsers
                accessor: name
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: DemistoUsers
                accessor: name
            iscontext: true
    view: |-
      {
        "position": {
          "x": 360,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 9156d781-74e6-4d09-8b0f-f3bb1ccb25ed
    type: regular
    task:
      id: 9156d781-74e6-4d09-8b0f-f3bb1ccb25ed
      version: -1
      name: Set open incidents  to layout
      description: Creates a grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      columns:
        simple: Incident ID,Incident name,Incident owner,Link to incident
      context_path:
        simple: foundIncidents
      grid_id:
        simple: shiftopenincidents
      keys:
        simple: id,name,owner,incidentLink
      overwrite: {}
      sort_by: {}
      unpack_nested_elements: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": 1270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: d3591c44-abaa-462e-863c-910c353039a7
    type: title
    task:
      id: d3591c44-abaa-462e-863c-910c353039a7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 52cd9a7e-8163-4256-8796-fb31e70eb386
    type: regular
    task:
      id: 52cd9a7e-8163-4256-8796-fb31e70eb386
      version: -1
      name: Search for Incidents
      description: Searches Cortex XSOAR incidents.
      scriptName: SearchIncidentsV2
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        simple: ${inputs.IncidentSearchQuery}
      reason: {}
      size: {}
      sort: {}
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 520,
          "y": 1100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "5_8_#default#": 0.21
    },
    "paper": {
      "dimensions": {
        "height": 1505,
        "width": 850,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: IncidentSearchQuery
  value:
    simple: 'status:active -category:job -type:"Shift handover" '
  required: false
  description: 'Query for the incidents to reassign. Incidents need to be active.
    It will not reassign pending incidents. '
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0