Delay playbook action issue

[ORBR]

Hello,

Has anyone else experienced issues with the "Delay Playbook" or "Delay Playbook V2"?

I attempted to run a 30-second test, but it kept getting stuck indefinitely.

Any workarounds?

[JensW · Accepted solution]

Did you change the async polling interval? The default is set to an hour. You can change it in the action settings.

[ORBR]

@JensW So I need to change the async polling interval according to how long I want to delay the playbook? 30 seconds delay=async 30 seconds?

What if I want to delay it for 2-3 days?

[JensW]

@ORBR You should always adjust the polling interval depending on the delay duration. In the worst case, badly chosen intervals could result in an unintended increase in the delay.

For example, your selected delay is 1min. You have selected 40 sec as the polling interval. After 40 sec, the system checks if the delay has expired. Thats not the case. Another 40 sec pass. Now the delay has expired but you are already  20 sec over it.

A delay of several days shouldn't be possible, according to the docs, the action will timeout after one day (https://cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/service-limits#playbook-limits)