Using timer events

Timer events are used only for user tasks, functions, and message destinations that expect an acknowledgment. If the task is not completed or the message destination does not receive an acknowledgment in a specified time, the workflow proceeds to the designated step. One example of using a timer is to proceed to a different task when the initial user task is not completed within 24 hours.

The two types of timer events are interrupting and non-interrupting.

interrupting timer icon

An interrupting timer event invalidates all outgoing paths from the user task or message destination when the timer fires. For example, use an interrupting timer event to escalate the incident to another team when a task is not completed in a specified time.
non-interrupting timer icon

A noninterrupting timer event does not invalidate the outgoing paths. For example, use a noninterrupting timer event to send an email when a task is not completed in a specified time, but continue to the next step when the task is completed.

You can also repeat the occurrence of a non-interrupting timer. For example, you can configure a non-interrupting timer to send an email each hour for eight occurrences, which would be an 8-hour period or until the task is marked complete. You can also set it to repeat forever or until the task is completed.

Review the following behaviors before you use timer events:
  • Using too many timers in a timeframe, such as 120 timers per minute, can impact performance.
  • Having timers access too many tasks, such as 1,000 tasks, can also impact performance.
  • If the SOAR Platform goes offline, a non-interrupting timer that repeats might skip some of the occurrences. For example, a timer is set to repeat every 15 minutes for four occurrences (a total of 1 hour). It might run for one occurrence if the platform goes offline then comes back within 45 minutes.
  • Due to the nature of workflows, repeating timers might not run exactly on the minute that the timer is set to repeat. For example, a timer set to repeat every hour might run after 61 minutes then run 63 minutes on the next occurrence.
Follow these steps to use a timer event in your workflow.
  1. Drag the Timer Event icon and attach it to the User Task or Message Destination icon.

    All timer events are non-interrupting by default when you drag them into the workflow.

  2. To have the timer event be an interrupting timer, click the timer event then click its wrench icon and select Timer (interrupting).
    Note: You can switch it back to non-interrupting by clicking the timer event’s wrench icon again.
  3. Click the timer event again and click its pencil icon to edit it.
  4. Enter the name of the time event and the elapsed time, which is the time to wait before it runs.
  5. For a non-interrupting timer, you can also set the number of occurrences that the timer repeats.

    Timer Properties

  6. Click Save when done.