Configure a Sub-playbook Loop

Configure a sub-playbook to run in a loop. Cortex XSOAR subplaybook looping
You can configure a sub-playbook to run in a loop. When running the loop, the values are calculated based on the context data for the sub-playbook and not the parent playbook.
You configure when to exit the loop by selecting one of the following options:
  • For Each Input
    - the loop will exit automatically when the array it is looping over executes the last item in the array
    • If the input is a single item, the sub-playbook will run one time. However, if the input is a list of items (such as a list of alert IDs), the sub-playbook will run as many times as there are items in the list. Each iteration of the sub-playbook will use the next item in the list as the input.
    • If there are multiple input lists with the same amount of items, then the sub-playbook will run once for each set of inputs. For example if we have input1 and input2, input1[i] will run with input2[i].
    • If there are multiple input lists with different amounts of items, then the sub-playbook will run once for each item in the input that has more items. When the input that has less items reaches its last item, the subsequent runs will continue to use the last item in the shorter list until all items in the largest list have run.
  • Built-in
    or
    Choose Loop Automation
    - the loop will exit based on a condition. The playbook will not loop through the inputs but will take the inputs as a whole.
  1. Select the sub-playbook for which you want to create the loop and click the edit icon.
  2. Click the
    Loop
    tab.
  3. Click one of the following options to define when to exit the loop:
    • None
      - The sub-playbook shouldn’t run multiple times.
    • Built-in
      - Define the following options for the Cortex XSOAR built-in functions :
      Option
      Description
      Exit when
      Click {} and expand the source category. Hover over the required source and click
      Filter & Transform
      to the left of the source to manipulate the data. For information about configuring filters and transformers, see Filters and Transformers.
      Equals
      Select the operator to define how the values should be evaluated.
      Max iterations
      The number of times the loop should run.
      Sleep
      The number of seconds to wait between iterations.
      Cortex XSOAR recommends that you balance between the number of iterations and the number of seconds to wait between iterations so you don't overload the server.
    • For each input
      - Run the sub-playbook for all defined inputs. Enter the number of seconds to wait between iterations.
    • Choose Loop automation
      - Select the automation from the drop down list to define when to exit the loop. The parameters that appear are applicable to the selected automation.

Recommended For You