Shift Management | Cortex XSOAR

This pack's purpose is to provide a single interface for all those essential elements of Shift management and handover in one place.

Shift management and shift handover are crucial processes of SOC team management.
This pack's purpose is provide a single interface for all those essential elements in one place in order to prevent loss of data in the shift handover process.

What does this pack do?

Automatically reassign active incidents to the next shift
Setting up online meeting
Sending notification on relevant messaging apps.
Providing SOC manager briefing for the team.
Managing out of the office users.

For more information, visit our Cortex XSOAR Developer Docs

Shift_management_layout

PUBLISHER

Cortex XSOAR

INFO

Certification	Certified	Read more
Supported By	Cortex XSOAR
Created	June 30, 2020
Last Release	November 28, 2021

Case Management

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

Automations

Name	Description
GetUsersOOO	Retrieves users who are currently out of the office. The script use the OutOfOfficeListCleanup script to remove users from the out-of-office list whose 'off until day' is in the past.
GetNumberOfUsersOnCall	Retrieves the number of users who are currently on call.
GetShiftsPerUser	Retrieves the number of on-call hours per user.
TimeToNextShift	Retrieves the time left until the next shift begins.
GetRolesPerShift	Retrieves the roles that are available per shift.
AssignToNextShiftOOO	Randomly assigns the active incidents to on call analysts (requires shift management). This automation works with the other out-of-office automations to ensure only available analysts are assigned to the active incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
GetOnCallHoursPerUser	Retrieves the number of on call hours per user.
AssignAnalystToIncidentOOO	Assigns analysts who are not out of the office to the shift handover incident. Use the ManageOOOusers automation to add or remove analysts from the out-of-office list. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
CreateChannelWrapper	Creates a channel in Slack v2 or in Microsoft Teams. If both Slack v2 and Microsoft Teams are available, it creates the channel in both Slack v2 and Microsoft Teams.
OutOfOfficeListCleanup	Removes any users from the out-of-office list whose 'off until day' is in the past.
ManageOOOusers	Adds or removes an analyst from the out-of-office list in XSOAR. When used with the AssignAnalystToIncidentOOO automation, prevents incidents from being assigned to an analyst who is out of office.
GetUsersOnCall	Retrieves users who are currently on call.

Incident Fields

Name	Description
To start the meeting
To join the meeting
Out off the office
Shift open incidents
Shift manager briefing

Playbooks

Name	Description
Assign Active Incidents to Next Shift V2	This playbook reassigns Active Incidents to the current users on call. It requires shift management to be set up. The playbook can be run as a job a few minutes after the scheduled shift change time. You can update the playbook input with a different search query, if required. Will branch if there are no incidents that match the query and no users on call. Cases will not be assigned to users that defined OOO (by OutOfOffice automation).
Set up a Shift handover meeting	This playbook is used to create an online meeting for shift handover. Currently, this playbook supports Zoom.
Shift handover	This playbook is used to set up shift handover meetings with all the accompanying processes such as creating an online meeting, creating a notification in a integrated chat app (for example Slack), creating a SOC manager briefing, and creating a display of the active incidents, team members who are on-call, and team members who are out of the office. By modifying the playbook inputs you can decide whether to activate the Assign Active Incidents to Next Shift and whether a user who is out of the office will be taken into consideration.

Incident Types

Name	Description
Shift handover

Widgets

Name	Description
Number Of Users On-Call
On-Call Hours Per User
Out of office users
Shift changes in
Users On-Call
Roles Per Shift

Layouts

Name	Description
Shift handover	SOC shift change layout is part of shift management pack, this layout is managing the SOC shift change.

Dashboards

Name	Description
Shift Management

1.3.2 - 2020903 (November 28, 2021)

Scripts

Multiple Scrips Changes:

Added reference to required permissions in automation's description and README.

AssignAnalystToIncidentOOO
AssignToNextShiftOOO

1.3.1 - 1988895 (November 21, 2021)

Scripts

AssignToNextShiftOOO

Fixed the failure running the AssignToNextShiftOOO script in playbooks.
Updated the Docker image to: demisto/python3:3.9.8.24399.

1.3.0 - 1882648 (November 2, 2021)

Scripts

Breaking Change The following breaking change applies for organizations that implement pre-set roles on their incidents:
DBotRole has been removed from these automations. This change will affect any playbook that is dependent on, or runs, these automations.
These automations will now run using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html

##### AssignAnalystToIncidentOOO
##### AssignToNextShiftOOO
##### CreateChannelWrapper

1.2.7 - R1790547 (October 13, 2021)

Scripts

ManageOOOusers

Fixed issue where script failed when running via playbook

1.2.6 - 1779968 (October 11, 2021)

Scripts

OutOfOfficeListCleanup

Fixed an issue where the script failed to run when the list of users was not changed.

1.2.5 - 7772209 (September 25, 2021)

Scripts

AssignAnalystToIncidentOOO

Updated the Docker image to: demisto/python3:3.9.7.24076.

AssignToNextShiftOOO

Updated the Docker image to: demisto/python3:3.9.7.24076.

CreateChannelWrapper

Updated the Docker image to: demisto/python3:3.9.7.24076.

GetNumberOfUsersOnCall

Updated the Docker image to: demisto/python3:3.9.7.24076.

GetOnCallHoursPerUser

Updated the Docker image to: demisto/python3:3.9.7.24076.

GetRolesPerShift

Updated the Docker image to: demisto/python3:3.9.7.24076.

GetShiftsPerUser

Updated the Docker image to: demisto/python3:3.9.7.24076.

GetUsersOOO

Updated the Docker image to: demisto/python3:3.9.7.24076.

GetUsersOnCall

Updated the Docker image to: demisto/python3:3.9.7.24076.

ManageOOOusers

Updated the Docker image to: demisto/python3:3.9.7.24076.

OutOfOfficeListCleanup

Updated the Docker image to: demisto/python3:3.9.7.24076.

TimeToNextShift

Updated the Docker image to: demisto/python3:3.9.7.24076.

1.2.4 - 388887 (June 23, 2021)

Scripts

GetNumberOfUsersOnCall

Upgraded the Docker image to: demisto/python3:3.9.5.21272.

GetOnCallHoursPerUser

Upgraded the Docker image to: demisto/python3:3.9.5.21272.

GetRolesPerShift

Upgraded the Docker image to: demisto/python3:3.9.5.21272.

GetShiftsPerUser

Upgraded the Docker image to: demisto/python3:3.9.5.21272.

GetUsersOOO

Upgraded the Docker image to: demisto/python3:3.9.5.21272.

GetUsersOnCall

Upgraded the Docker image to: demisto/python3:3.9.5.21272.

TimeToNextShift

Upgraded the Docker image to: demisto/python3:3.9.5.21272.

1.2.3 - 381353 (June 8, 2021)

Scripts

GetNumberOfUsersOnCall

Upgraded the Docker image to: demisto/python3:3.9.5.20958.

GetOnCallHoursPerUser

Upgraded the Docker image to: demisto/python3:3.9.5.20958.

GetRolesPerShift

Upgraded the Docker image to: demisto/python3:3.9.5.20958.

GetShiftsPerUser

Upgraded the Docker image to: demisto/python3:3.9.5.20958.

GetUsersOOO

Upgraded the Docker image to: demisto/python3:3.9.5.20958.

GetUsersOnCall

Upgraded the Docker image to: demisto/python3:3.9.5.20958.

TimeToNextShift

Upgraded the Docker image to: demisto/python3:3.9.5.20958.

1.2.2 - R281301 (February 15, 2021)

Dashboards

New: Shift Management

(Available from Cortex XSOAR 6.0.0).

Scripts

GetUsersOOO

Fixed message description.

GetUsersOnCall

Fixed message description.

1.2.1 - R269341 (February 2, 2021)

Incident Fields

Out off the office
To start the meeting
To join the meeting
Shift open incidents
**Shift manager briefing **

Incident Types

Shift handover

Layouts

shift handover

Playbooks

New: Set up a Shift handover meeting

This playbook is used to create an online meeting for shift handover. Currently, this playbook supports Zoom. (Available from Cortex XSOAR 6.0.0).

New: Assign Active Incidents to Next Shift V2

This playbook reassigns Active Incidents to the current users on call. It requires shift management to be set up. The playbook can be run as a job a few minutes after the scheduled shift change time.

You can update the playbook input with a different search query, if required. Will branch if there are no incidents that match the query and no users on call.

Cases will not be assigned to users that defined OOO (by OutOfOffice automation). (Available from Cortex XSOAR 6.0.0).

Scripts

GetUsersOOO

Fixed an issue when the OOO List is empty.

1.2.0 - R263971 (January 27, 2021)

Scripts

GetUsersOnCall

Added the argument listname that allows users to specify a new name for the Out Of Office list. The default name is OOO List.

GetShiftsPerUser

Upgraded the Docker image to demisto/python3:3.9.1.14969.

GetRolesPerShift

Upgraded the Docker image to demisto/python3:3.9.1.14969.

GetNumberOfUsersOnCall

Upgraded the Docker image to demisto/python3:3.9.1.14969.

GetOnCallHoursPerUser

Upgraded the Docker image to demisto/python3:3.9.1.14969.

New: CreateChannelWrapper

Creates a channel in Slack v2 or in Microsoft Teams. If both Slack v2 and Microsoft Teams are available, it creates the channel in both Slack v2 and Microsoft Teams. (Available from Cortex XSOAR 5.5.0).

New: AssignToNextShiftOOO

Randomly assigns the incidents to on call analysts (requires shift management). This automation is used for reassigning a large number of incidents to the next shift. It works with the other out-of-office automations to ensure only available analysts get assigned. Incident IDs should be passed as a comma-separated list. (Available from Cortex XSOAR 5.0.0).

New: TimeToNextShift

Retrieves the time left until the next shift begins. (Available from Cortex XSOAR 5.5.0).

New: AssignAnalystToIncidentOOO

Assigns an analyst to an incident with consideration of PTO, OOO, or other unavailability. Users can use the ManageOOOusers automation to add or remove themselves from the out of office list. (Available from Cortex XSOAR 5.5.0).

New: ManageOOOusers

Adds or removes an analyst from the out-of-office list in XSOAR. When used with the AssignAnalystToIncidentOOO automation, prevents incidents from being assigned to an analyst who is out of the office. (Available from Cortex XSOAR 5.5.0).

New: OutOfOfficeListCleanup

Removes any analyst from the out-of-office list whose 'off until day' is in the past. (Available from Cortex XSOAR 5.5.0).

New: GetUsersOOO

Retrieves users who are currently out of office. (Available from Cortex XSOAR 5.5.0).

Widgets

New: Out of office users

Details of the users who are currently out of office. (Available from Cortex XSOAR 5.5.0).

New: Shift changes in

Displays the amount of time left until the end of shift. (Available from Cortex XSOAR 5.5.0).

1.1.4 - R253472 (January 16, 2021)

Scripts

GetUsersOnCall

Added the new argument include_OOO_users which allows users to choose whether to include in the output users that are Out Of Office. By default, Out Of Office users are not included in the output.
Upgraded the Docker image to demisto/pyjwt3:1.0.0.8871.

1.1.3 - R180529 (November 9, 2020)

Scripts

GetOnCallHoursPerUser

Fixed an issue where the output format was incorrect.

1.1.2 - 94020 (August 24, 2020)

Scripts

GetOnCallHoursPerUser

Internal code improvements.

GetRolesPerShift

Internal code improvements.

GetNumberOfUsersOnCall

Internal code improvements.

GetShiftsPerUser

Internal code improvements.

GetUsersOnCall

Internal code improvements.

1.1.1 - 60526 (June 30, 2020)