Configure timeouts for playbook async actions

Supported in:

Google secops SOAR

This document explains how to configure and manage timeout settings for Asynchronous (Async) playbook actions. Async actions, which execute over an extended period or require periodic checks, can have individual timeouts defined in the Integrated Development Environment (IDE) and then customized within each playbook step to facilitate workflow control and prevent resource blocking.

1. In the Google Security Operations platform, go to Response > IDE .
2. Click add Create New Item to create a new action.
3. Enter the required details.
4. On the Action Type menu, select Async and click Create.
5. In the Timeout configuration section, various timeouts appear that you can define:
• Script Timeout: The amount of time for a single iteration of the action to run to get a result (20 minutes maximum).
• Async Action Timeout: The amount of time until the action should stop running altogether.
• Async Polling Interval: The amount of time the action waits before trying again.
  You can also add individual parameters in the Details tab.
6. Enable the action and click Save.
7. Go to Response > Playbooks.
8. Choose an existing playbook or create a new one, and then drag it into your new action.
9. Click the action. The Async Action Timeout and Async Polling Interval fields appear with the amounts configured in the IDE.
   
   Note: You can change these amounts in the playbook step itself. This lets you set different timeouts for different steps using the same action. Any further changes made in the IDE don't override the values already saved in this specific playbook step.

Need more help? Get answers from Community members and Google SecOps professionals.