Shift Management

Name	Description
AssignAnalystToIncidentOOO	Assigns analysts who are not out of the office to the shift handover incident. Use the ManageOOOusers automation to add or remove analysts from the out-of-office list. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
GetUsersOnCall	Retrieves users who are currently on call.
ManageOOOusers	Adds or removes an analyst from the out-of-office list in XSOAR. When used with the AssignAnalystToIncidentOOO automation, prevents incidents from being assigned to an analyst who is out of office.
CreateChannelWrapper	Creates a channel in Slack v2 or in Microsoft Teams. If both Slack v2 and Microsoft Teams are available, it creates the channel in both Slack v2 and Microsoft Teams.
TimeToNextShift	Retrieves the time left until the next shift begins.
GetOnCallHoursPerUser	Retrieves the number of on call hours per user.
AssignToNextShiftOOO	Randomly assigns the active incidents to on call analysts (requires shift management). This automation works with the other out-of-office automations to ensure only available analysts are assigned to the active incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
OutOfOfficeListCleanup	Removes any users from the out-of-office list whose 'off until day' is in the past.
GetRolesPerShift	Retrieves the roles that are available per shift.
GetUsersOOO	Retrieves users who are currently out of the office. The script use the OutOfOfficeListCleanup script to remove users from the out-of-office list whose 'off until day' is in the past.
GetNumberOfUsersOnCall	Retrieves the number of users who are currently on call.
GetShiftsPerUser	Retrieves the number of on-call hours per user.
GetAwayUsers	Returns a list of all the users marked as away in Cortex XSOAR.

Name

Description

Assigns analysts who are not out of the office to the shift handover incident.
Use the ManageOOOusers automation to add or remove analysts from the out-of-office list.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations

GetUsersOnCall

Retrieves users who are currently on call.

ManageOOOusers

Adds or removes an analyst from the out-of-office list in XSOAR. When used with the AssignAnalystToIncidentOOO automation, prevents incidents from being assigned to an analyst who is out of office.

CreateChannelWrapper

Creates a channel in Slack v2 or in Microsoft Teams. If both Slack v2 and Microsoft Teams are available, it creates the channel in both Slack v2 and Microsoft Teams.

TimeToNextShift

Retrieves the time left until the next shift begins.

GetOnCallHoursPerUser

Retrieves the number of on call hours per user.

AssignToNextShiftOOO

Randomly assigns the active incidents to on call analysts (requires shift management).
This automation works with the other out-of-office automations to ensure only available analysts are assigned to the active incidents.

OutOfOfficeListCleanup

Removes any users from the out-of-office list whose 'off until day' is in the past.

GetRolesPerShift

Retrieves the roles that are available per shift.

GetUsersOOO

Retrieves users who are currently out of the office. The script use the OutOfOfficeListCleanup script to remove users from the out-of-office list whose 'off until day' is in the past.

GetNumberOfUsersOnCall

Retrieves the number of users who are currently on call.

GetShiftsPerUser

Retrieves the number of on-call hours per user.

GetAwayUsers

Returns a list of all the users marked as away in Cortex XSOAR.

Name	Description
Shift Management

Name

Description

Shift Management

Name	Description
Shift open incidents
To start the meeting
Out off the office
Shift manager briefing
To join the meeting

Name

Description

Shift open incidents

To start the meeting

Out off the office

Shift manager briefing

To join the meeting

Name	Description
Shift handover

Name

Description

Shift handover

Name	Description
Shift handover	SOC shift change layout is part of shift management pack, this layout is managing the SOC shift change.

Name

Description

Shift handover

SOC shift change layout is part of shift management pack, this layout is managing the SOC shift change.

Name	Description
Assign Active Incidents to Next Shift V2	This playbook reassigns Active Incidents to the current users on call. It requires shift management to be set up. The playbook can be run as a job a few minutes after the scheduled shift change time. You can update the playbook input with a different search query, if required. Will branch if there are no incidents that match the query and no users on call. Cases will not be assigned to users that defined OOO (by OutOfOffice automation).
Shift handover	This playbook is used to set up shift handover meetings with all the accompanying processes such as creating an online meeting, creating a notification in a integrated chat app (for example Slack), creating a SOC manager briefing, and creating a display of the active incidents, team members who are on-call, and team members who are out of the office. By modifying the playbook inputs you can decide whether to activate the Assign Active Incidents to Next Shift and whether a user who is out of the office will be taken into consideration.
Set up a Shift handover meeting	This playbook is used to create an online meeting for shift handover. Currently, this playbook supports Zoom.

Name

Description

Assign Active Incidents to Next Shift V2

This playbook reassigns Active Incidents to the current users on call. It requires shift management to be set up. The playbook can be run as a job a few minutes after the scheduled shift change time.

You can update the playbook input with a different search query, if required. Will branch if there are no incidents that match the query and no users on call.

Cases will not be assigned to users that defined OOO (by OutOfOffice automation).

Shift handover

This playbook is used to set up shift handover meetings with all the accompanying processes such as creating an online meeting, creating a notification in a integrated chat app (for example Slack), creating a SOC manager briefing, and creating a display of the active incidents, team members who are on-call, and team members who are out of the office.
By modifying the playbook inputs you can decide whether to activate the Assign Active Incidents to Next Shift and whether a user who is out of the office will be taken into consideration.

Set up a Shift handover meeting

This playbook is used to create an online meeting for shift handover. Currently, this playbook supports Zoom.

Name	Description
Users On-Call	Details of the users that are currently on-call
Roles Per Shift	Roles per shift 24x7
On-Call Hours Per User	Displays number of on-call hours per user.
Out of office users	Details of the users that are currently out of office
AwayUsers	Details of the users that are currently away
Number Of Users On-Call	Displays the number of users that are currently on-call.
Shift changes in	Shows how much time left for the shift to ends.

Name

Description

Users On-Call

Details of the users that are currently on-call

Roles Per Shift

Roles per shift 24x7

On-Call Hours Per User

Displays number of on-call hours per user.

Out of office users

Details of the users that are currently out of office

AwayUsers

Details of the users that are currently away

Number Of Users On-Call

Displays the number of users that are currently on-call.

Shift changes in

Shows how much time left for the shift to ends.

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Pack Name	Pack By
Microsoft Teams	By: Cortex XSOAR
Slack	By: Cortex XSOAR
Zoom	By: Cortex XSOAR

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR

Dashboards

Added the AwayUsers widget to the dashboard.

Scripts

AssignAnalystToIncidentOOO

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

AssignToNextShiftOOO

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetNumberOfUsersOnCall

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetUsersOnCall

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetAwayUsers

Added support of using the script as a widget.
Updated the docker image to: demisto/python3:3.9.9.25564.

Widgets

New: AwayUsers

Details of the users that are currently away (Available from Cortex XSOAR 5.5.0).

Certification	Certified	Read more
Supported By	Cortex
Created	June 30, 2020
Last Release	April 7, 2024

Shift Management