topic Re: Playbook runs in Playbooks page but not with incident in Cortex XSOAR Discussions

Playbook runs in Playbooks page but not with incident

GWynn — Tue, 22 Aug 2023 05:40:32 GMT

Hello all,

I have a playbook, the one from XSOAr Engineer you tube course actually, video #8, sub-playbooks. This runs flawlessly in the playbook page but when I run it from an incident it ends up trying to reset the password for every AD user even though I specify james.bond as the user. I am not sure of the logic. It doesn't seem to "call" the playbook from the incident, it's almost as though it's a "copy" and so has it's own settings and not those in the playbook? I'll add a screenshot to show what I mean. So I hard-code james.bond in the playbook, save the playbook, call the playbook from an incident and it proceeds to lookup ALL users in AD? What am I missing??!

Thanks,

Geoff

Re: Playbook runs in Playbooks page but not with incident

jfernandes1 — Tue, 22 Aug 2023 06:20:07 GMT

Hi @GWynn, Need to see what the actual command looks like. Can you send the full command with its passed parameters?

Re: Playbook runs in Playbooks page but not with incident

GWynn — Tue, 22 Aug 2023 09:33:40 GMT

Hello @jfernandes1 As shown here it tries to reset the password for everyone, which fails! How do I specify just james?

Re: Playbook runs in Playbooks page but not with incident

GWynn — Tue, 22 Aug 2023 12:04:25 GMT

Here is a screenshot of the sub-playbook with some skipped tasks, but when I run from the incident it STILL runs these??! What am I missing?! Yes I am saving when I make these changes.

Re: Playbook runs in Playbooks page but not with incident

jfernandes1 — Wed, 23 Aug 2023 04:37:52 GMT

Hi @GWynn, the task skip button only works during the playbook debug process. The task will be included when run in an incident.

Looking at the command input, it looks like your passing all the user names to the command. So it working as expected. There must be something wrong with the input.

Check the playbook task input, you can set it like below, where the value is hardcoded.

Or you can set it like below, where the value is grabbed from the context. Remember, the playbook debugger uses a different context than the incident so you might experience different behaviours. You can select an existing incident or choose a new mock incident.

When you use this method, if the previous command (AD Get User) returned more than 1 result or the playbook was run multiple times it could pass more usernames. You can check value by copying ${ActiveDirectory.Users.sAMAccountName} to the Context Data search. Like below.

Added the !DeleteContext all=true task to the start of your playbook is a good way to ensure that playbooks work as designed.

Re: Playbook runs in Playbooks page but not with incident

GWynn — Wed, 23 Aug 2023 06:18:51 GMT

Hello @jfernandes1 thanks for this, I have managed to add in the !DeleteContext all=true command at the start but I am manually inputting the user everywhere I can see! It still won't seem to work, which of course defies logic. I will have another look but it's a small playbook!

Re: Playbook runs in Playbooks page but not with incident

GWynn — Wed, 23 Aug 2023 06:27:38 GMT

Error!

And results:

You can see here, in the sub-playbook it is all manually inputted apart from the expire password task. So... it still tried to reset all users passwords!!

Re: Playbook runs in Playbooks page but not with incident

jfernandes1 — Wed, 23 Aug 2023 08:09:55 GMT

Hi @GWynn Send me the playbook, I'll test and make the correction.

Re: Playbook runs in Playbooks page but not with incident

GWynn — Wed, 23 Aug 2023 11:56:13 GMT

Hello @jfernandes1 here are the files. Thanks so much for doing this, sorry to be a pain, I am trying to learn this stuff! Cheers,

Geoff

Re: Playbook runs in Playbooks page but not with incident

GWynn — Thu, 24 Aug 2023 06:49:13 GMT

Hello @jfernandes1 I think I have solved the problem. In the playbook when you override the input it must only be for de-bugging the playbook not for the actual incident! Same thing as the break-point. It only works in debugging mode.

Re: Playbook runs in Playbooks page but not with incident

jfernandes1 — Thu, 24 Aug 2023 06:54:34 GMT

HI @GWynn, Only a slight modification was required. Try and let me know if they work.

My use of the "FirstArrayElement" transformer as an example. Its not required for this case. I think you need to search AD for username to ensure only 1 result is returned since a email address might be associated to more than one account.

I tested the playbook with the debugger and in a fresh incident. Works in both cases.

Re: Playbook runs in Playbooks page but not with incident

GWynn — Thu, 24 Aug 2023 09:44:36 GMT

Hello @jfernandes1 thanks for this, yes seems to work but then resets all my users passwords which is "ok" but not ideal! I will play and see if I can somehow prompt for the username to be used/reset. Thanks!! It gets complicated!

Re: Playbook runs in Playbooks page but not with incident

jfernandes1 — Thu, 24 Aug 2023 14:21:55 GMT

Hi @GWynn, Are you saying that its still passing more that 1 user to the ad-reset-password command? I think there might be some extra information in your context, I thought the DeleteContex might help. Keep at it and it should work. Maybe try re-creating the playbook 1 step at a time. Add print task to output context keys before passing them to the next task. Validate if the value in the print task matches your expectation for the next task input.

For manual input, you can leave a mandatory field blank. It will halt the playbook process and allow you to enter the value

In the screenshot below, delete the value of username field in the ad-set-new-password task(1). Run the playbook, wait for it task to fail (2). Open the failed task, add the new run-time value (3) and click "Run automation now"(4).

Another, more complex method is to implement a Data Collection task.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Create-a-Data-Collection-Task

Re: Playbook runs in Playbooks page but not with incident

GWynn — Fri, 25 Aug 2023 08:08:44 GMT

Hello @jfernandes1 thanks again for this, I'll keep tweaking it until I get it right! Thanks so much for your help. Cheers,

Geoff