topic Re: Find playbooks and subplaybooks not being used in Cortex XSOAR Discussions

Find playbooks and subplaybooks not being used

Josep — Sun, 13 Nov 2022 21:41:34 GMT

Hello,

Our XSOAR complexity has increased during the years, this means more playbooks and subplaybooks deployed.

However, some of them are not used anymore, many reasons about it.

How can these unnecessary playbooks and subplaybooks detected and erased?

Thanks

Re: Find playbooks and subplaybooks not being used

sramesh-7 — Mon, 14 Nov 2022 16:42:00 GMT

Hi,

In Dashboards, there is a SOAR metrics based widget which records the number of playbook executionS, You can compare this with list of all custom playbooks you have to find out which are the playbooks not used at all and delete them.

Create a new widget and Select data source as SOAR Metrics, use this query - type:playbook and group results by Name to get the playbooks used.

Re: Find playbooks and subplaybooks not being used

Josep — Wed, 16 Nov 2022 07:30:00 GMT

Hello, thanks for the reply,

It only shows the most used playbooks when I following the steps you describe.