XDR Automation Rules not triggering Playbook execution

[.522643]

I am experiencing an issue with XDR Automation Rules when attempting to execute a script.

I have configured an automation rule to trigger a Playbooks when a specific event occurs. The Playbook is designed to run the built-in Quick Action: “Run Endpoint Script”, which executes a script registered in Action Center > Scripts Library.

However, the automation rule does not execute the Playbook when the event is triggered.

In contrast, when I go to the Issues menu, right-click a detected event, and select “Run Automation”, the same Playbooks executes successfully without any issues.

Could you please advise why the Automation Rules are not triggering the Playbook execution?

I am using the XDR Pro version, and I understand this functionality should be supported.

Additionally, are there any restrictions on the types of events that Automation Rules can be applied to?

[susekar]

Hello @.522643 ,

Greetings for the day.

(Why Cortex XDR Automation Rules May Not Trigger)

There are several design behaviors and platform restrictions that explain why an automation rule may fail to trigger, even though manual execution of the same playbook works successfully.

Core Reasons for Trigger Failure:

1. Alert Severity Restriction

Automation rules generally trigger only for alerts with a severity of Medium, High, or Critical.

Alerts with Low or Informational severity typically do not support automatic execution. However, manual execution via the Issues menu bypasses this limitation.

 

2. Action Limit Thresholds (Failsafes):

To prevent unintended large-scale impact, Cortex XDR enforces limits on sensitive actions such as:

• Run Endpoint Script
• Isolate Endpoint

Threshold Behavior:

• If a single rule triggers more than 5 actions across 5 distinct hosts within a 24-hour period, the system will automatically pause the rule and stop further executions.

What to Check:

• Review the Automation Audit Log for entries showing a Paused status to confirm whether this threshold has been exceeded.

3. Rule Processing Order:

Legacy XDR

• Rules are processed in the order they appear.
• If a higher-priority rule matches and has “Stop processing after this rule” enabled, subsequent rules will not be evaluated.

Unified Platform

• Rules are evaluated from top to bottom.
• Processing stops as soon as the first matching rule is found.

4. Incident Grouping Requirement

Automation rules apply only to alerts that are successfully grouped into incidents.

• If an alert is not assigned to an incident, the rule will not trigger.

5. Missing Endpoint Data

If the triggering alert (often from a custom Correlation Rule) does not include required fields such as agent_id or endpoint context:

• Actions like Run Endpoint Script will fail because the system cannot determine the target endpoint.

 

(Restrictions on Event Types)

New Alerts Only

• Automation rules apply only to newly generated alerts.
• They do not run retroactively on past alerts, even if those alerts match the rule conditions.

Incident Association Required

• The alert must be associated with an incident for the automation rule to execute.

Minimum Severity Requirement

• Most automated actions require alerts to have a severity higher than Low/Informational.

Scoped Access (SBAC)

• If Scoped Server Access Control (SBAC) is enabled:
  • Automation rules will only trigger for endpoints that fall within the user’s defined scope tags.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[rufat87]

Is this valuable information available in the related documentation?

[Michael.Kaufmann]

"Automation rules generally trigger only for alerts with a severity of Medium, High, or Critical."
As far as I see it this is only documented for XDR 3: "Automation rules only apply to alerts that are grouped into incidents by the system. Most alerts with low and informational severity do not allow an automation rule to be automatically executed on them."
https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incid...
Is that also true for XDR 5? 

[susekar]

Hello @Michael.Kaufmann ,

Thank you for the response.

Yes, this behavior remains true in Cortex XDR 5 (as well as Cortex XSIAM).

The underlying incident generation and automation architecture remains fundamentally the same between XDR 3 and XDR 5.

1. Incident-Based Automation

• Automation rules and playbooks are triggered by alerts associated with an incident (case).
• Standalone alerts that are not associated with an incident are not processed by incident-based automation rules.
  
  

2. Severity Threshold for Incident Creation

• By default, Cortex XDR creates incidents for alerts with Medium, High, or Critical severity.
• Low and Informational alerts generally remain standalone and do not trigger incident-based automation.
  
  

3. Exceptions for Low-Severity Alerts

Low-severity alerts can still trigger automation in the following scenarios:

• When they are associated with an existing active incident.
• When generated by specific modules, such as:
  • Identity Threat Detection (ITDR).
  • Cloud Detection.
  • XDR Analytics (Magnifier).
    
    

4. How to Automate Low/Informational Alerts

If automation is required for low-severity detections, consider the following approaches:

• Adjust Detection Severity: Configure supported detection rules to generate alerts with Medium or higher severity.
• Use Correlation Rules: Create a correlation rule to identify relevant low-severity events and generate a Medium/High severity alert, allowing an incident to be created and automation to execute.
  
  

Conclusion: Cortex XDR automation is primarily incident-driven. To ensure low-severity detections trigger automated actions, they must be associated with an existing incident or generate a new incident through an appropriate detection or correlation rule.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar