Shift Management

Details
Content
Dependencies
Version History

This pack's purpose is to provide a single interface for all those essential elements of Shift management and handover in one place.

Shift management and shift handover are crucial processes of SOC team management.
This pack's purpose is provide a single interface for all those essential elements in one place in order to prevent loss of data in the shift handover process.

What does this pack do?

Automatically reassign active incidents to the next shift
Setting up online meeting
Sending notification on relevant messaging apps.
Providing SOC manager briefing for the team.
Managing out of the office users.

For more information, visit our Cortex XSOAR Developer Docs

Shift_management_layout

Automations

Name	Description
GetUsersOOO	Retrieves users who are currently out of the office. The script use the OutOfOfficeListCleanup script to remove users from the out-of-office list whose 'off until day' is in the past.
GetRolesPerShift	Retrieves the roles that are available per shift.
AssignToNextShiftOOO	Randomly assigns the active incidents to on call analysts (requires shift management). This automation works with the other out-of-office automations to ensure only available analysts are assigned to the active incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 use the link https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations and for Cortex XSOAR 8 Cloud use the link https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script.
GetOnCallHoursPerUser	Retrieves the number of on call hours per user.
GetAwayUsers	Returns a list of all the users marked as away in Cortex XSOAR.
ManageOOOusers	Adds or removes an analyst from the out-of-office list in XSOAR. When used with the AssignAnalystToIncidentOOO automation, prevents incidents from being assigned to an analyst who is out of office.
GetNumberOfUsersOnCall	Retrieves the number of users who are currently on call.
TimeToNextShift	Retrieves the time left until the next shift begins.
OutOfOfficeListCleanup	Removes any users from the out-of-office list whose 'off until day' is in the past.
AssignAnalystToIncidentOOO	Assigns analysts who are not out of the office to the shift handover incident. Use the ManageOOOusers automation to add or remove analysts from the out-of-office list. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 use the link https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations and for Cortex XSOAR 8 Cloud use the link https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script.
GetUsersOnCall	Retrieves users who are currently on call.
CreateChannelWrapper	Creates a channel in Slack v2 or in Microsoft Teams. If both Slack v2 and Microsoft Teams are available, it creates the channel in both Slack v2 and Microsoft Teams.
GetShiftsPerUser	Retrieves the number of on-call hours per user.

Dashboards

Name	Description
Shift Management

Incident Fields

Name	Description
To join the meeting
Shift manager briefing
To start the meeting
Shift open incidents
Out of the office

Incident Types

Name	Description
Shift handover

Layouts

Name	Description
Shift handover	SOC shift change layout is part of shift management pack, this layout is managing the SOC shift change.

Playbooks

Name	Description
Assign Active Incidents to Next Shift V2	This playbook reassigns Active Incidents to the current users on call. It requires shift management to be set up. The playbook can be run as a job a few minutes after the scheduled shift change time. You can update the playbook input with a different search query, if required. Will branch if there are no incidents that match the query and no users on call. Cases will not be assigned to users that defined OOO (by OutOfOffice automation).
Set up a Shift handover meeting	This playbook is used to create an online meeting for shift handover. Currently, this playbook supports Zoom.
Shift handover	This playbook is used to set up shift handover meetings with all the accompanying processes such as creating an online meeting, creating a notification in a integrated chat app (for example Slack), creating a SOC manager briefing, and creating a display of the active incidents, team members who are on-call, and team members who are out of the office. By modifying the playbook inputs you can decide whether to activate the Assign Active Incidents to Next Shift and whether a user who is out of the office will be taken into consideration.

Widgets

Name	Description
AwayUsers	Details of the users that are currently away
Roles Per Shift	Roles per shift 24x7
Out of office users	Details of the users that are currently out of office
Number Of Users On-Call	Displays the number of users that are currently on-call.
On-Call Hours Per User	Displays number of on-call hours per user.
Users On-Call	Details of the users that are currently on-call
Shift changes in	Shows how much time left for the shift to ends.

Required Content Packs (4)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (3)

Pack Name	Pack By
Microsoft Teams	By: Cortex XSOAR
Slack	By: Cortex XSOAR
Zoom	By: Cortex XSOAR

All level dependencies (5)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

1.3.15 - 1869532 (December 25, 2024)

Scripts

ManageOOOusers

Fixed an issue where the script failed to create a new list in XSOAR SaaS.

OutOfOfficeListCleanup

Fixed an issue where the script failed to create a new list in XSOAR SaaS.

Related pull requests:
- 37827

Download

1.3.14 - 1867101 (December 24, 2024)

Playbooks

Assign Active Incidents to Next Shift V2

Documentation and metadata improvements.

Scripts

AssignAnalystToIncidentOOO

Documentation and metadata improvements.

AssignToNextShiftOOO

Documentation and metadata improvements.

Related pull requests:
- 37687

Download

1.3.13 - 1718057 (November 28, 2024)

Scripts

AssignToNextShiftOOO

Updated the Docker image to: demisto/python3:3.11.10.115186.

TimeToNextShift

Updated the Docker image to: demisto/python3:3.11.10.115186.

CreateChannelWrapper

Updated the Docker image to: demisto/python3:3.11.10.115186.

OutOfOfficeListCleanup

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetUsersOnCall

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetAwayUsers

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetShiftsPerUser

Updated the Docker image to: demisto/python3:3.11.10.115186.

AssignAnalystToIncidentOOO

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetOnCallHoursPerUser

Updated the Docker image to: demisto/python3:3.11.10.115186.

ManageOOOusers

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetNumberOfUsersOnCall

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetUsersOOO

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetRolesPerShift

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37407
- 37402
- 37403
- 37405
- 37406
- 37404

Download

1.3.12 - 1012872 (May 12, 2024)

Incident Fields

Out of the office - Updated the incident field outoffofthefice to be outofofthefice.

Layouts

Shift handover
Updated the reference to incident field outoffofthefice to be outofofthefice.

Playbooks

Set up a Shift handover meeting

Updated the reference to incident field outoffofthefice to outofofthefice.

Shift handover

Updated the reference to incident field outoffofthefice to outofofthefice.

Related pull requests:
- 34234

Download

1.3.11 - R995825 (May 5, 2024)

Scripts

AssignToNextShiftOOO

Updated the Docker image to: demisto/python3:3.10.14.91134.

ManageOOOusers

Updated the Docker image to: demisto/python3:3.10.14.91134.

CreateChannelWrapper

Updated the Docker image to: demisto/python3:3.10.14.91134.

Related pull requests:
- 33641
- 33516
- 33519
- 33515
- 33329
- 33314
- 33318
- 33328
- 33357
- 33344
- 33359
- 33458
- 33535
- 33534
- 33537
- 33552
- 33580
- 33553
- 33418
- 33583
- 33555
- 33556
- 33559
- 33560
- 33619
- 33591
- 33602
- 33600
- 33314
- 33318
- 33328
- 33357
- 33344
- 33359
- 33458

Download

1.3.10 - 865088 (March 3, 2024)

Scripts

TimeToNextShift

Updated the Docker image to: demisto/python3:3.10.13.87159.

Related pull requests:
- 33020

Download

1.3.9 - 722180 (December 28, 2023)

Scripts

OutOfOfficeListCleanup

Updated the Docker image to: demisto/python3:3.10.13.83255.

GetUsersOnCall

Updated the Docker image to: demisto/python3:3.10.13.83255.

GetShiftsPerUser

Updated the Docker image to: demisto/python3:3.10.13.83255.

GetOnCallHoursPerUser

Updated the Docker image to: demisto/python3:3.10.13.83255.

GetRolesPerShift

Updated the Docker image to: demisto/python3:3.10.13.83255.

GetUsersOOO

Updated the Docker image to: demisto/python3:3.10.13.83255.

AssignAnalystToIncidentOOO

Updated the Docker image to: demisto/python3:3.10.13.83255.

GetAwayUsers

Updated the Docker image to: demisto/python3:3.10.13.83255.

GetNumberOfUsersOnCall

Updated the Docker image to: demisto/python3:3.10.13.83255.

Related pull requests:
- 31812

Download

1.3.8 - 7012606 (November 28, 2023)

Scripts

OutOfOfficeListCleanup

Updated the script to better handle an empty list of users.
Updated the Docker image to: demisto/python3:3.10.13.80593.

GetUsersOOO

Updated the script to better handle an empty list of users.
Updated the Docker image to: demisto/python3:3.10.13.80593.

Related pull requests:
- 31130

Download

1.3.7 - R5866730 (July 25, 2023)

Scripts

AssignAnalystToIncidentOOO

Updated the Docker image to: demisto/python3:3.10.10.48392.
Documentation and metadata improvements.

AssignToNextShiftOOO

Updated the Docker image to: demisto/python3:3.10.10.48392.
Documentation and metadata improvements.

Related pull requests:
- 23716

Download

1.3.6 - R4718798 (March 1, 2023)

Playbooks

Assign Active Incidents to Next Shift V2

Documentation and metadata improvements.

Related pull requests:
- 23715

Download

1.3.5 - R3921089 (October 26, 2022)

Scripts

GetAwayUsers

Removed excessive error traceback printing.
Updated the Docker image to: demisto/python3:3.10.5.31797.

Related pull requests:
- 19638

Download

1.3.4 - R2233034 (January 10, 2022)

Dashboards

Shift Management

Added the AwayUsers widget to the dashboard.

Scripts

AssignAnalystToIncidentOOO

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

AssignToNextShiftOOO

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetNumberOfUsersOnCall

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetUsersOnCall

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetAwayUsers

Added support of using the script as a widget.
Updated the docker image to: demisto/python3:3.9.9.25564.

Widgets

New: AwayUsers

Details of the users that are currently away (Available from Cortex XSOAR 5.5.0).

Download

1.3.3 - 2167894 (December 27, 2021)

Scripts

New: GetAwayUsers

Returns a list of all the users marked as away in Cortex XSOAR (Available from Cortex XSOAR 5.5.0).

GetUsersOnCall

The script will now filter users that are set as Away.

AssignAnalystToIncidentOOO

The script will now filter users that are set as Away.

GetNumberOfUsersOnCall

The script will now filter users that are set as Away.

AssignToNextShiftOOO

The script will now filter users that are set as Away.

Download

1.3.2 - R2146019 (December 21, 2021)

Scripts

Multiple Scrips Changes:

Added reference to required permissions in automation's description and README.

AssignAnalystToIncidentOOO
AssignToNextShiftOOO

Download

1.3.1 - 1988895 (November 21, 2021)

Scripts

AssignToNextShiftOOO

Fixed the failure running the AssignToNextShiftOOO script in playbooks.
Updated the Docker image to: demisto/python3:3.9.8.24399.

Download

1.3.0 - 1882648 (November 2, 2021)

Scripts

Breaking Change The following breaking change applies for organizations that implement pre-set roles on their incidents:
DBotRole has been removed from these automations. This change will affect any playbook that is dependent on, or runs, these automations.
These automations will now run using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html

##### AssignAnalystToIncidentOOO
##### AssignToNextShiftOOO
##### CreateChannelWrapper

Download

1.2.7 - R1790547 (October 13, 2021)

Scripts

ManageOOOusers

Fixed issue where script failed when running via playbook

Download

PUBLISHER

PLATFORMS

Cortex XSOAR

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	June 30, 2020
Last Release	December 25, 2024

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.