> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-a-feed.md).

# Create a job triggered by a delta in a feed

Jobs triggered by a delta in a feed (event triggered jobs) run when a feed completes an operation and there is a change in the content. For the job to trigger, there must be a delta between the incoming feed and the previous one. You can define a job to trigger a playbook when the specified feed or feeds finish a fetch operation that includes a modification to the feed. The modification can be a new indicator, a modified indicator, or a removed indicator. For example, you may want to update your firewall every time a URL is added, modified, or removed from the Office 365 feed. You can configure a job that triggers the firewall update playbook to run whenever a modification is made to the feed.

For an example of using a job triggered by a delta in a feed, see the [Create jobs to process indicators example](/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/jobs/create-jobs-to-process-indicators-example.md).

{% hint style="info" %}

### Note

A job triggered by a delta in a feed runs only if there is a change in the feed, and does not run on a feed’s initial fetch. For the initial fetch, you can run the playbook manually and then set up an event triggered job for subsequent fetches.

If you want to trigger a job after a feed completes a fetch operation and the feed does not change frequently, you can select the **Reset last seen** option in the feed integration instance. The next time the feed fetches indicators, it will process them as new indicators in the system.
{% endhint %}

1. Select **Jobs** → **New Job**.
2. Select **Triggered by delta in feed**.
3. Add or create any relevant tags to use as a search parameter in the system.
4. In the **Trigger** section, select one of the following:
   * **Any feed**: The playbook runs when a modification is made to any feed.
   * **Specific feeds**: Select the feed instances that will trigger the playbook to run when a modification is made to them.
5. In the **BASIC INFORMATION** section:
   * Add a meaningful name for the job.
   * Select the playbook you want to run when the conditions for the job are met.
6. **Create new job**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-a-feed.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.