Create a loop in a playbook

What specific use case would there be for a loop?

In cases where I need something to happen over X amount, I'll make a custom IDE action for it.

You could attach the same playbook after some *if* condition so it repeats and then pull a value from a global list, but I don't use the global list feature so I am not too sure how that would be implemented. 

Well, kind of. Just not within the same playbook.

For instance, I have a playbook that gets a suspicious file from an endpoint, but what if the endpoint is offline?

I created a duplicate of the Playbook. If the host is offline playbook one will delay for 8 hours then call playbook two.

Playbook two will check and if the host is offline delay eight hours and call Playbook one.

10 times is the max any playbook can run

This appears to be coming soon, at least in part: https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/playbook-loops#loop-start

Yes Looping in a playbook is under private preview I believe, so it’s hopefully not too long before it’s GA for all manner of new use cases!!

Many actions now are Async, and you can specify a polling interval/frequency.  This however does have a top end. 

As you mention, you could havetry > (if work, bypass to end) > delay 8 hours > try > (if work, bypass to end) > delay 8 hours > try > (if work, bypass to end) > delay 8 hours.  One playbook could do lots of these.  Multiply by 10 reruns and should cover several weeks.

A completely different angle: split the playbook in two halves on the point of get-file.  Then create a Job that will look for open Cases tagged ‘awaiting-file’ run a manual actions to collect, and if it works then add playbook 2 via sdk.  This could in theory run forever. 

Hopefully that gives some ideas

Andy