Create a Feed-Triggered Job

Configure a job to trigger a playbook when a specified feed completes a fetch operation in Cortex XSOAR.
You can define a job to trigger a playbook when the specified feed or feeds finish a fetch operation that included a modification to the feed. The modification can be a new indicator, a modified indicator, or a removed indicator.
For example, let’s say you want to update your firewall every time a URL is added to, modified, or removed from the Office 365 feed. You can configure a job that triggers that playbook to run whenever a modification is made to that feed.
You can customize the new job form by editing the Indicator Feed incident type.
If you want to trigger a job after a feed completes a fetch operation, and the feed does not change frequently, you can select the
Reset last seen
option in the feed integration instance. The next time the feed fetches indicators, it will process them as new indicators in the system.
  1. Go to the
  2. Click the
    New Job
  3. Configure the job parameters.
    Job type
    Select the
    Triggered by delta in feed
    Define the trigger for the playbook.
    • Any feed
      : the playbook will run when a modification is made to any feed.
    • Specific feeds
      : select the feed instances that will trigger the playbook to run when a modification is made to the specified feed instances.
    A meaningful name for the job.
    The playbook that will run when the conditions for the job are met.
    Add tags to apply to the job, which you can use as a search parameter in the system.

Recommended For You