Reduce the Size of Work Plans
12773
Created On 03/18/21 07:41 AM - Last Modified 08/02/23 10:13 AM
Symptom
There are several symptoms that might indicate work plans are too large (more than 3 MB).
- Playbooks are executing slowly.
- You experience memory spikes.
- Client is loading slowly (especially for incidents).
Environment
- Cortex XSOAR
- Version 6.1 and 6.2.
Cause
- Playbooks are storing a large amount of data to task inputs and outputs.
- A high number of indicators are being enriched.
- Enrichment integrations return a large amount of data per indicator.
- Playbooks are looping on too many arguments during a playbook run.
Resolution
Each of these resolution steps are optional and need not be completed in a specific order.
- Mark specific tasks, or even entire playbooks, to run in Quiet Mode. In Quiet Mode, inputs and outputs are not displayed, but outputs are still written to context.
- Check for inefficient tasks and unnecessary loops in a playbook.
- Verify that you are only extracting and enriching indicators required for investigations.
- Large work plan data can be purged directly from the Systems Diagnostics page.