You need to automate a SOAR playbook task to run once every day at a specific time with minimal overhead. What should you do?

• A. Create a SOAR request and a playbook trigger matching the request.
• B. Create a Cron Scheduled Connector and configure a playbook trigger to match cases created by the connector.
• C. Write a custom SOAR job in the IDE using code from playbook actions.
• D. Use a VM to host a script that runs a playbook via an API call.

Answer: (B)

Scheduling tasks inside a SOAR environment is best done with a built-in time-based trigger. A Cron Scheduled Connector provides a recurring, low-overhead way to fire off automation at a specific time each day. By wiring a playbook trigger to the events or cases created by that connector, you achieve a reliable daily run without manual input or external dependencies. This keeps everything self-contained in the SOAR platform, reducing maintenance and potential points of failure.

Other approaches introduce unnecessary overhead. Creating a request and tying a playbook to that request still relies on event-driven input and manual or semi-automatic steps, which isn’t ideal for a strict daily schedule. Writing a custom job in the IDE means maintaining custom code and deployment processes outside the platform. Hosting a script on a VM adds external infrastructure, security considerations, and synchronization issues, all adding complexity and overhead. The Cron-based approach is the cleanest, most automated path to a daily, time-specific run.