Configure a playbook to run timers

Configure Cortex XSIAM playbooks to start, pause, and stop issue timers for response-time tracking and automated workflows.

Within a playbook, you can set a timer to start, pause, or stop at a specific section header or task. For example, you can create a timer called Pending user response and have it start in a playbook when an email is sent to a user. If the user does not respond within the target timeframe, then you can automatically send an additional reminder to the user or run a different task.

To select a timer in a task or section header, in the Timers tab select the action that you want the timer to perform for the task. You can add multiple timers to a task or section header, so in the same task you can stop one timer and start another.

When a task or section has a timer configured, it displays the hourglass icon.

The following table describes the timer options:

Option	Description
Timer.start	Starts the timer. Timers are not started automatically when a case is created.
Timer.pause	Pauses the timer. A paused timer can be started again without being reset.
Timer.stop	Stops the timer. Information about the timer is still displayed in the issue layout and/or issues table, but the status displays as Ended. If you stop a timer before the issue is closed, you must reset the timer using the resetTimer command before you can start the timer again. When you reset the timer, all fields are cleared.

Some playbooks, such as Phishing - Generic v3, come out-of-the-box with timer tasks included. If you need the same timers across use cases, create a sub-playbook based on your use case or conditions such as issue severity.

If you want to stop or pause a timer in a playbook, you can use an existing task or create a new section header/task. When you select Timer.stop, the run is considered finished and cannot be restarted without setting it to zero. If you plan to restart the timer, select Timer.pause so you do not lose the accumulated time. By default, all timers stop when the case closes.