> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/jobs/create-a-time-triggered-job.md). # Create a time-triggered job Time-triggered jobs run at predetermined times. You can schedule the job to run at a recurring time or one time at a specific date and time. {% hint style="warning" %} ### Configure your playbook to close the investigation A scheduled job automatically opens an internal investigation container to run its playbook. Because the platform allows for manual post-playbook analysis, finishing the playbook tasks does not automatically close this container. If left open, the overall job remains stuck in a Running status. To ensure a consistent UI status, you must add a task to close the investigation at the end of your playbook: 1. Navigate to **Investigation & Response** → **Automation** → **Playbook** and open the playbook in the editor. 2. In the **Task Library** on the left, search for closeInvestigation (this is an out-of-the-box system command) located under **Builtin Commands**. 3. Add the closeInvestigation task to your canvas and configure it as the final step on the successful execution path of your playbook. {% endhint %} 4. Select **Investigation & Response** → **Automation** → **Jobs** → **New Job**. 5. Select **Time triggered**. 6. If you want the job to repeat at regular intervals, select **Recurring** and select the desired interval. You can choose to run the job every X number of days, on specific days of the week, at a specific time and also choose a start date and an expiration date. You can configure the recurring job using a cron expression. To do so, after selecting the **Recurring** checkbox, click **Switch to Cron view** and enter the expression. For help defining the cron expression, click **Show cron examples** after switching to cron view.

To view a human-readable description of a cron schedule for an existing job, click settings-wheel.png and select Job Schedule from the available columns.

7. If you do not want the job to repeat, select the **date and time** for the job to run. 8. In the **BASIC INFORMATION**, section, add relevant time-triggered job parameters from the following: | Name | Description | | ----------- | ----------------------------------------------------------- | | Name | Enter a meaningful name for the job. | | Playbook | Determine which playbook to run when this job is triggered. | | Description | Enter a meaningful description of the job. | 9. In the **QUEUE HANDLING** section, select one of the following response options to use if the job is triggered while a previous run of the job is active: * Don’t trigger a new job run * Cancel the previous job run and trigger a new job run * Trigger a new job run and execute concurrently with the previous run

We recommend avoiding triggering a job while a previous run of the job is active by configuring the playbook a job triggers to close the investigation before running a new instance of the job.

10. Ensure that the playbook assigned to this job includes the closeInvestigation built-in command as its final execution step. This action closes the underlying container workspace and enables the user interface to show the accurate completion status. 11. Select **Create new job**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/jobs/create-a-time-triggered-job.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.