Bulk Actions on Streams and Baselines

Streams

Devo SOAR allows you to perform bulk actions on Streams such as pause and resume, and bulk edit.

You can pause a scheduled stream and then resume it at a later time. This option is useful, for example, if you want to modify a playbook that already has an associated stream. You can pause the stream, modify the underlying playbook, and then resume the stream.

For streams, the following rules apply:

• You can't pause on-demand streams, only scheduled ones.

• You can't pause or resume a system-level stream.

• If you pause a stream with multiple batches that are currently executing or scheduled, all of the batches finish executing but no new batches are scheduled during the pause.

To pause and resume a stream:

1. Select My Library > Streams on the left navigation.

2. Select checkboxes for the stream or streams you want to pause.

3. Click Pause in the gray action bar. If Pause isn't shown as an option, it means that the stream isn't scheduled and can't be paused.

4. The stream status changes to Paused.

5. To resume the paused baselines, select them and click Resume.

Bulk Actions for Batches on Streams

Streams allow you to filter based on the status and exclude batches with 0 events. You can also perform bulk actions for batches.

1. Click on any stream to view the list of batches.

1. Click Status and select the status to filter the batches.

2. Click Exclude Batches with 0 events to filter the batches that have greater than one event.
   In cases such as Skipped, Canceled, and Error status, the number of events processed will be zero. So, you can use this option to filter out batches that contain zero events.

To perform bulk action on the batches:

1. Select multiple batches that you want to perform bulk actions. You will see two filter options:

2. Rerun Error and Cancelled: Use this option to rerun the error batches that show an Error and Canceled status.

3. Cancel queued and scheduled: Use this option to cancel the batches that are in Queued and Scheduled status.

Stream Specific Actions in Batches

Streams allow you to perform Pause, Edit, Share, and Delete actions in the batches page for a selected stream and its associated batches.

Baselines

To pause and resume a baseline:

1. Select My Library > Baselines on the left navigation.

2. Select checkboxes for the baseline or baselines you want to pause.

3. Click Pause in the gray action bar. If Pause isn't shown as an option, it means that the baseline isn't scheduled and can't be paused.

4. The baseline status changes to Paused.

5. To resume the paused baselines, select them and click Resume.

Bulk Actions for Batches on Baselines

Baselines allow you to filter the batches based on the status and exclude batches with 0 events. You can also perform bulk actions for batches.

1. Click on any baseline to view the list of batches.

1. Click Status and select the status to filter the batches.

2. Click Exclude Batches with 0 events to filter the batches that have greater than one event.
   In cases such as Skipped, Canceled, and Error status, the number of events processed will be zero. So, you can use this option to filter out batches that contain zero events.

To perform bulk action on the batches for baselines:

1. Select multiple batches that you want to perform bulk actions. You will see two filter options:

2. Rerun Error and Cancelled: Use this option to rerun the error batches that show an Error and Canceled status.

3. Cancel queued and scheduled: Use this option to cancel the batches that are in Queued and Scheduled status.

Baseline Specific Actions in Batches

Baselines allow you to perform Pause, Edit, Share, and Delete actions in the batches page for a selected stream and its associated batches.

Bulk Action on Streams and Baselines

Devo SOAR allows you to perform bulk action on streams and baselines. This feature is useful to configure streams and baselines in bulk at scheduled intervals.

To configure stream settings in bulk:

1. Go to My Library > Streams on the left navigation.

2. Select multiple streams that you want to schedule in bulk.

3. Click Edit.

4. Enter the Batch Length and Execution Delay in minutes or hours.
   While configuring the batch length, you can click to Schedule with CRON syntax or set up webhook that allows you to run frequency using regular input or CRON or using webhook.
   Additionally, you can use the Show Options to enable correlations and auto-forward options.

5. Click Save.

Show Options

To configure baseline settings in bulk:

1. Go to My Library > Baselines on the left navigation.

2. Select multiple baselines that you want to schedule in bulk.

3. Click Edit.

4. Enter the Batch Length and Execution Delay in minutes or hours.
   Additionally, you can schedule with CRON syntax.

5. Enter the Number of Past Batches for comparison.

6. Click Save.