Shift Management - Assign to Next Shift

Randomly assigns the incidents to users on call (requires shift management) and users on call.
See for more information: Cortex XSOAR 6.13 Cortex XSOAR 8 Cloud Cortex XSOAR 8.7 On-prem
Incident IDs should be passed as a comma-separated list.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

This playbook reassigns Active Incidents to the current users on call, requires shift management to be setup. Can be run as a job a few minutes after the scheduled shift change time.

Update the playbook input with a different search query if required. Will also branch if there are no Incidents that match the query, and no users on call.

Search results are the default 100 Incidents returned by the query.

Randomly assigns the incidents to users on call (requires shift management) and users on call.
See for more information: Cortex.13 Cortex Cloud Cortex.7 On-prem
Incident IDs should be passed as a comma-separated list.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

This playbook reassigns Active Alerts to the current users on call, requires shift management to be setup. Can be run as a job a few minutes after the scheduled shift change time.

Update the playbook input with a different search query if required. Will also branch if there are no Alerts that match the query, and no users on call.

Search results are the default 100 Alerts returned by the query.