Shift Management

Details
Content
Dependencies
Version History
Download With Dependencies

This pack's purpose is to provide a single interface for all those essential elements of Shift management and handover in one place.

Shift management and shift handover are crucial processes of SOC team management.
This pack's purpose is provide a single interface for all those essential elements in one place in order to prevent loss of data in the shift handover process.

What does this pack do?

Automatically reassign active incidents to the next shift
Setting up online meeting
Sending notification on relevant messaging apps.
Providing SOC manager briefing for the team.
Managing out of the office users.

For more information, visit our Cortex XSOAR Developer Docs

Shift_management_layout

PUBLISHER

Cortex XSOAR

INFO

Certification	Certified	Read more
Supported By	Cortex XSOAR
Created	June 30, 2020
Last Release	January 10, 2022

Case Management

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

Playbooks

Name	Description
Shift handover	This playbook is used to set up shift handover meetings with all the accompanying processes such as creating an online meeting, creating a notification in a integrated chat app (for example Slack), creating a SOC manager briefing, and creating a display of the active incidents, team members who are on-call, and team members who are out of the office. By modifying the playbook inputs you can decide whether to activate the Assign Active Incidents to Next Shift and whether a user who is out of the office will be taken into consideration.
Assign Active Incidents to Next Shift V2	This playbook reassigns Active Incidents to the current users on call. It requires shift management to be set up. The playbook can be run as a job a few minutes after the scheduled shift change time. You can update the playbook input with a different search query, if required. Will branch if there are no incidents that match the query and no users on call. Cases will not be assigned to users that defined OOO (by OutOfOffice automation).
Set up a Shift handover meeting	This playbook is used to create an online meeting for shift handover. Currently, this playbook supports Zoom.

Automations

Name	Description
GetUsersOOO	Retrieves users who are currently out of the office. The script use the OutOfOfficeListCleanup script to remove users from the out-of-office list whose 'off until day' is in the past.
ManageOOOusers	Adds or removes an analyst from the out-of-office list in XSOAR. When used with the AssignAnalystToIncidentOOO automation, prevents incidents from being assigned to an analyst who is out of office.
CreateChannelWrapper	Creates a channel in Slack v2 or in Microsoft Teams. If both Slack v2 and Microsoft Teams are available, it creates the channel in both Slack v2 and Microsoft Teams.
GetNumberOfUsersOnCall	Retrieves the number of users who are currently on call.
GetOnCallHoursPerUser	Retrieves the number of on call hours per user.
AssignAnalystToIncidentOOO	Assigns analysts who are not out of the office to the shift handover incident. Use the ManageOOOusers automation to add or remove analysts from the out-of-office list. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
TimeToNextShift	Retrieves the time left until the next shift begins.
GetRolesPerShift	Retrieves the roles that are available per shift.
AssignToNextShiftOOO	Randomly assigns the active incidents to on call analysts (requires shift management). This automation works with the other out-of-office automations to ensure only available analysts are assigned to the active incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
OutOfOfficeListCleanup	Removes any users from the out-of-office list whose 'off until day' is in the past.
GetShiftsPerUser	Retrieves the number of on-call hours per user.
GetUsersOnCall	Retrieves users who are currently on call.
GetAwayUsers	Returns a list of all the users marked as away in Cortex XSOAR.

Incident Fields

Name	Description
Shift manager briefing
To start the meeting
Out off the office
Shift open incidents
To join the meeting

Incident Types

Name	Description
Shift handover

Layouts

Name	Description
Shift handover	SOC shift change layout is part of shift management pack, this layout is managing the SOC shift change.

Widgets

Name	Description
AwayUsers
Shift changes in
Users On-Call
Out of office users
Roles Per Shift
On-Call Hours Per User
Number Of Users On-Call

Dashboards

Name	Description
Shift Management

Required Content Packs (4)

Pack Name	Pack By
Base	By: Cortex XSOAR
CommonTypes	By: Cortex XSOAR
CommonScripts	By: Cortex XSOAR
DemistoRESTAPI	By: Cortex XSOAR

Optional Content Packs (3)

Pack Name	Pack By
MicrosoftTeams	By: Cortex XSOAR
Zoom	By: Cortex XSOAR
Slack	By: Cortex XSOAR

1.3.4 - R2233034 (January 10, 2022)

Dashboards

Shift Management

Added the AwayUsers widget to the dashboard.

Scripts

AssignAnalystToIncidentOOO

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

AssignToNextShiftOOO

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetNumberOfUsersOnCall

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetUsersOnCall

Maintenance and stability enhancements.
Updated the docker image to: demisto/python3:3.9.9.25564.

GetAwayUsers

Added support of using the script as a widget.
Updated the docker image to: demisto/python3:3.9.9.25564.

Widgets

New: AwayUsers

Details of the users that are currently away (Available from Cortex XSOAR 5.5.0).

Shift Management

What does this pack do?

PUBLISHER

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Dashboards

Shift Management

Scripts

AssignAnalystToIncidentOOO

AssignToNextShiftOOO

GetNumberOfUsersOnCall

GetUsersOnCall

GetAwayUsers

Widgets

New: AwayUsers

Scripts

New: GetAwayUsers

GetUsersOnCall

AssignAnalystToIncidentOOO

GetNumberOfUsersOnCall

AssignToNextShiftOOO

Scripts

Multiple Scrips Changes:

Scripts

AssignToNextShiftOOO

Scripts

Scripts

ManageOOOusers

Scripts

OutOfOfficeListCleanup

Scripts

AssignAnalystToIncidentOOO

AssignToNextShiftOOO

CreateChannelWrapper

GetNumberOfUsersOnCall

GetOnCallHoursPerUser

GetRolesPerShift

GetShiftsPerUser

GetUsersOOO

GetUsersOnCall

ManageOOOusers

OutOfOfficeListCleanup

TimeToNextShift

Scripts

GetNumberOfUsersOnCall

GetOnCallHoursPerUser

GetRolesPerShift

GetShiftsPerUser

GetUsersOOO

GetUsersOnCall

TimeToNextShift

Scripts

GetNumberOfUsersOnCall

GetOnCallHoursPerUser

GetRolesPerShift

GetShiftsPerUser

GetUsersOOO

GetUsersOnCall

TimeToNextShift

Dashboards

New: Shift Management

Scripts

GetUsersOOO

GetUsersOnCall

Incident Fields

Incident Types

Layouts

Playbooks

New: Set up a Shift handover meeting

New: Assign Active Incidents to Next Shift V2

Scripts

GetUsersOOO

Scripts

GetUsersOnCall

GetShiftsPerUser

GetRolesPerShift

GetNumberOfUsersOnCall

GetOnCallHoursPerUser

New: CreateChannelWrapper