Tasks

When you click a task in the list, a drawer opens where you can view the details of the task, such as the summary, description, and Automation workflow assigned.

You can create a new task using the New Task drawer.

Note: Only users with the Administrator role are allowed to create tasks.

Perform the following steps to create a new task:

1. Choose Administration > Playbooks in the left navigation menu.

2. On the Playbooks page, click the Tasks tab.

3. Click Create task in the upper right corner of the page.



Note: If you navigate away from the NewTask drawer while editing, the content is automatically saved as a draft for the current browser tab only. The draft content is not available if the same session of Cisco XDR is opened in another browser tab. To restore the content, return to the New Task drawer and continue with your edits or click Undo or Use draft to remove or restore the draft content.

4. Enter a Name for the task and Summary.
5. In the Description text box, enter more information that fully describes the task, using the tools on the toolbar to format the text. Click the Preview tab to view the description as it will look when the task is published.
6. In the Automate task section, you can optionally include a workflow in the task. If you choose not to include a workflow, the task within the incident will include a button where the user can add a note as the response action.
7. To include an automated workflow in the task, click the Include Workflow toggle and choose the automated workflow from the Workflow name drop-down list.

The Observable types the workflow is designed to run on are displayed in the lower portion of the drawer. Any of these observable types that exist in the incident are available to select for input into the response task workflow.

8. Click Add task. The task is displayed in the Tasks tab.

If you edit a custom task in the Tasks tab that is associated with one or more playbooks, the updates affect all playbooks that have the task assigned. The updated task will apply to all future incidents, but it will not affect existing incidents.

Note: Only users with the Administrator role are allowed to edit tasks.

1. Choose Administration > Playbooks in the left navigation menu.

2. On the Playbooks page, click the Tasks tab.

3. Click a task link to open the task in the task drawer.

4. Click Edit task. If the task is assigned to a playbook, a warning message is displayed with a list of playbooks that will be affected by the task update. If you want to continue editing the task, click Continue to editing task.

5. Make the necessary changes and click Edit task or Apply changes to task when completed.

You can delete any custom task that is not assigned to a playbook. If the task is assigned to a playbook, you must remove the task from the playbook before you delete the task.

Note: Only users with the Administrator role are allowed to delete tasks.

1. Choose Administration > Playbooks in the left navigation menu.

2. On the Playbooks page, click the Tasks tab.

3. In the task list, click the (Ellipsis) icon for the task you want to delete and choose Delete from the drop-down list. Click Delete on the confirmation dialog box.

   A message is displayed if the task is assigned to any playbooks. You must remove the task from the playbooks to delete the task.

   Note: The Delete option is not available for Cisco managed tasks.

You can copy an existing task and modify the name, description, and workflow to customize it for your organization. You may want to use this option when you want to reuse some of the content in an existing task instead of creating a completely new task.

Note: Only users with the Administrator role are allowed to duplicate tasks.

1. Choose Administration > Playbooks in the left navigation menu.

2. On the Playbooks page, click the Tasks tab.

3. In the task list, click the (Ellipsis) icon for the task you want to copy and choose Duplicate from the drop-down list. A copy of the task is added to the Tasks tab.

4. Click the newly copied task name to open the task drawer and click Edit task to customize it. See Edit a Task for instructions.

If there are one or more counts in the Playbook count column, you can view all the playbooks that are associated with the current task. To view associated tasks, click the (Ellipsis) icon for the task and choose View associated playbooks from the drop-down list. A drawer is opened with a list of playbooks associated with the current task. Click the playbook link to open the playbook in a new tab.