Configure a job to trigger a playbook when a specified
feed completes a fetch operation in Cortex XSOAR.
You can define a job to trigger a playbook
when the specified feed or feeds finish a fetch operation that included
a modification to the feed. The modification can be a new indicator,
a modified indicator, or a removed indicator.
let’s say you want to update your firewall every time a URL is added
to, modified, or removed from the Office 365 feed. You can configure
a job that triggers that playbook to run whenever a modification
is made to that feed.
You can customize the new job form by
editing the Indicator Feed incident type.
If you want to trigger a job after a feed completes
a fetch operation, and the feed does not change frequently, you
can select the
Reset last seen
the feed integration instance. The next time the feed fetches indicators,
it will process them as new indicators in the system.
Go to the
Configure the job parameters.
Define the trigger for the playbook.
: the playbook will run when a modification is made to
: select the feed instances that will
trigger the playbook to run when a modification is made to the specified
A meaningful name for the job.
The playbook that will run when the conditions
for the job are met.
Add tags to apply to the job, which you can
use as a search parameter in the system.