Shift Management

Name	Description
GetUsersOnCall	Retrieves users who are currently on call.
GetShiftsPerUser	Retrieves the number of on-call hours per user.
GetNumberOfUsersOnCall	Retrieves the number of users who are currently on call.
ManageOOOusers	Adds or removes an analyst from the out-of-office list in XSOAR. When used with the AssignAnalystToIncidentOOO automation, prevents incidents from being assigned to an analyst who is out of office.
TimeToNextShift	Retrieves the time left until the next shift begins.
GetRolesPerShift	Retrieves the roles that are available per shift.
AssignToNextShiftOOO	Randomly assigns the active incidents to on call analysts (requires shift management). This automation works with the other out-of-office automations to ensure only available analysts are assigned to the active incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
GetUsersOOO	Retrieves users who are currently out of the office. The script use the OutOfOfficeListCleanup script to remove users from the out-of-office list whose 'off until day' is in the past.
GetOnCallHoursPerUser	Retrieves the number of on call hours per user.
OutOfOfficeListCleanup	Removes any users from the out-of-office list whose 'off until day' is in the past.
CreateChannelWrapper	Creates a channel in Slack v2 or in Microsoft Teams. If both Slack v2 and Microsoft Teams are available, it creates the channel in both Slack v2 and Microsoft Teams.
AssignAnalystToIncidentOOO	Assigns analysts who are not out of the office to the shift handover incident. Use the ManageOOOusers automation to add or remove analysts from the out-of-office list. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
GetAwayUsers	Returns a list of all the users marked as away in Cortex XSOAR.

Name

Description

GetUsersOnCall

Retrieves users who are currently on call.

GetShiftsPerUser

Retrieves the number of on-call hours per user.

GetNumberOfUsersOnCall

Retrieves the number of users who are currently on call.

ManageOOOusers

Adds or removes an analyst from the out-of-office list in XSOAR. When used with the AssignAnalystToIncidentOOO automation, prevents incidents from being assigned to an analyst who is out of office.

TimeToNextShift

Retrieves the time left until the next shift begins.

GetRolesPerShift

Retrieves the roles that are available per shift.

AssignToNextShiftOOO

Randomly assigns the active incidents to on call analysts (requires shift management).
This automation works with the other out-of-office automations to ensure only available analysts are assigned to the active incidents.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations

GetUsersOOO

Retrieves users who are currently out of the office. The script use the OutOfOfficeListCleanup script to remove users from the out-of-office list whose 'off until day' is in the past.

GetOnCallHoursPerUser

Retrieves the number of on call hours per user.

OutOfOfficeListCleanup

Removes any users from the out-of-office list whose 'off until day' is in the past.

CreateChannelWrapper

Creates a channel in Slack v2 or in Microsoft Teams. If both Slack v2 and Microsoft Teams are available, it creates the channel in both Slack v2 and Microsoft Teams.

AssignAnalystToIncidentOOO

Assigns analysts who are not out of the office to the shift handover incident.
Use the ManageOOOusers automation to add or remove analysts from the out-of-office list.

GetAwayUsers

Returns a list of all the users marked as away in Cortex XSOAR.

Name	Description
Shift Management

Name

Description

Shift Management

Name	Description
Shift manager briefing
To join the meeting
Out of the office
To start the meeting
Shift open incidents

Name

Description

Shift manager briefing

To join the meeting

Out of the office

To start the meeting

Shift open incidents

Name	Description
Shift handover

Name

Description

Shift handover

Name	Description
Shift handover	SOC shift change layout is part of shift management pack, this layout is managing the SOC shift change.

Name

Description

Shift handover

SOC shift change layout is part of shift management pack, this layout is managing the SOC shift change.

Name	Description
Set up a Shift handover meeting	This playbook is used to create an online meeting for shift handover. Currently, this playbook supports Zoom.
Shift handover	This playbook is used to set up shift handover meetings with all the accompanying processes such as creating an online meeting, creating a notification in a integrated chat app (for example Slack), creating a SOC manager briefing, and creating a display of the active incidents, team members who are on-call, and team members who are out of the office. By modifying the playbook inputs you can decide whether to activate the Assign Active Incidents to Next Shift and whether a user who is out of the office will be taken into consideration.
Assign Active Incidents to Next Shift V2	This playbook reassigns Active Incidents to the current users on call. It requires shift management to be set up. The playbook can be run as a job a few minutes after the scheduled shift change time. You can update the playbook input with a different search query, if required. Will branch if there are no incidents that match the query and no users on call. Cases will not be assigned to users that defined OOO (by OutOfOffice automation).

Name

Description

Set up a Shift handover meeting

This playbook is used to create an online meeting for shift handover. Currently, this playbook supports Zoom.

Shift handover

This playbook is used to set up shift handover meetings with all the accompanying processes such as creating an online meeting, creating a notification in a integrated chat app (for example Slack), creating a SOC manager briefing, and creating a display of the active incidents, team members who are on-call, and team members who are out of the office.
By modifying the playbook inputs you can decide whether to activate the Assign Active Incidents to Next Shift and whether a user who is out of the office will be taken into consideration.

Assign Active Incidents to Next Shift V2

This playbook reassigns Active Incidents to the current users on call. It requires shift management to be set up. The playbook can be run as a job a few minutes after the scheduled shift change time.

You can update the playbook input with a different search query, if required. Will branch if there are no incidents that match the query and no users on call.

Cases will not be assigned to users that defined OOO (by OutOfOffice automation).

Name	Description
Number Of Users On-Call	Displays the number of users that are currently on-call.
Shift changes in	Shows how much time left for the shift to ends.
AwayUsers	Details of the users that are currently away
Out of office users	Details of the users that are currently out of office
Users On-Call	Details of the users that are currently on-call
On-Call Hours Per User	Displays number of on-call hours per user.
Roles Per Shift	Roles per shift 24x7

Name

Description

Number Of Users On-Call

Displays the number of users that are currently on-call.

Shift changes in

Shows how much time left for the shift to ends.

AwayUsers

Details of the users that are currently away

Out of office users

Details of the users that are currently out of office

Users On-Call

Details of the users that are currently on-call

On-Call Hours Per User

Displays number of on-call hours per user.

Roles Per Shift

Roles per shift 24x7

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Pack Name	Pack By
Microsoft Teams	By: Cortex XSOAR
Slack	By: Cortex XSOAR
Zoom	By: Cortex XSOAR

Pack Name	Pack By
Base	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

Dashboards

Added the AwayUsers widget to the dashboard.

Scripts

AssignAnalystToIncidentOOO

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

AssignToNextShiftOOO

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetNumberOfUsersOnCall

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetUsersOnCall

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetAwayUsers

Added support of using the script as a widget.
Updated the docker image to: demisto/python3:3.9.9.25564.

Widgets

New: AwayUsers

Details of the users that are currently away (Available from Cortex XSOAR 5.5.0).

Certification	Certified	Read more
Supported By	Cortex
Created	June 30, 2020
Last Release	May 12, 2024

Shift Management