Create a Feed-Triggered Job

Configure a job to trigger a playbook when a specified feed completes a fetch operation.
You can define a job to trigger a playbook when the specified feed or feeds finish a fetch operation that included a modification to the feed. The modification can be a new indicator, a modified indicator, or a removed indicator.
For example, let’s say you want to update your firewall every time a URL is added to, modified, or removed from the Office 365 feed. You can configure a job that triggers that playbook to run whenever a modification is made to that feed.
You can customize the new job form by editing the
Indicator Feed
incident type.
If you want to trigger a job after a feed completes a fetch operation, and the feed does not change frequently, you can select the
Reset last seen
option in the feed integration instance. The next time the feed fetches indicators, it will process them as new indicators in the system.
  1. Go to the
  2. Click the
    New Job
  3. Configure the job parameters.
    Job type
    Select the
    Feed triggered
    Define the trigger for the playbook.
    • All feeds
      : the playbook will run when a modification is made to any feed.
    • Specific feeds
      : select the feed instances that will trigger the playbook to run when a modification is made to the specified feed instances.
    A meaningful name for the job.
    The playbook that will run when the conditions for the job are met.
    Add tags to apply to the job, which you can use as a search parameter in the system.

Recommended For You