Enter the following, leave the other fields at their default
values:
Time triggered: (select)
Recurring:
Select this because you want to periodically import device attributes
from Cortex XDR.
Every: Enter a number
and set the interval value (Minutes, Hours, Days, or Weeks) and
select the days on which to run the job. (If you don’t select anything,
the job runs everyday.) This determines how often XSOAR imports
data from Cortex XDR. It’s important to set an interval that provides
enough time for the job to complete, considering factors such as
the number of devices that are active on the network. You might
start by running the job every 15 minutes and then increasing it
as necessary until each job completes before the next one starts.
You can see the run status of a recurring job on the Jobs page.
When in progress, its status is Running. When
done, its status changes to Completed.
Name: Type a name for the job such as XDR
device attributes retrieval.
Playbook: Incremental Export of Cortex XDR
- PANW IoT 3rd Party Integration
Integration
Instance Name: Paste the integration instance name that
you copied in the previous step. If this field is empty or an entered
name does not match an instance, the job won’t run successfully.
Playbook
Poll Interval: Enter a number (the value, though unspecified,
is minutes) defining the period of time during which Device Security
must see newly discovered devices or network activity from previously
discovered devices to import device attributes from XDR. It’s common
to use the same interval as the one for running the recurring job.
However, if you increase the interval between jobs, you can set
a shorter interval for polling than that for the job. If you leave
it blank, the default poll interval is 15 minutes.
The
default value is 15 minutes.
Site Names:
Leave the field empty to import device attributes for all sites.
To limit imports to devices at one or more sites, enter comma-separated site
names.
