topic Re: How can i trigger playbook once Indicator has beed added? in Cortex XSOAR Discussions

How can i trigger playbook once Indicator has beed added?

a.alimaherbarqsystemscom — Thu, 15 May 2025 23:30:53 GMT

Hi,

I need to setup an automatic playbook trigger, when an indicator has added which his type is IP, a specific playbook should run?

Re: How can i trigger playbook once Indicator has beed added?

mattem — Thu, 22 May 2025 02:24:56 GMT

Are you able to configure a Classifier to assign a specific playbook when the Incident meets your criteria, including having an Indicator of type=IPv4 associated with the Incident?

Re: How can i trigger playbook once Indicator has beed added?

mbgonzalez — Thu, 05 Jun 2025 19:18:32 GMT

I wouldn't recommend that because if you get an incident with 500 IPs, XSOAR will execute the same playbook at the same time, and its not very efficient. I think the best is to focus on when you get an incident from, like if its from a specific integration and incident type