Playbook runs in Playbooks page but not with incident

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Playbook runs in Playbooks page but not with incident

L3 Networker

Hello all,

 

I have a playbook, the one from XSOAr Engineer you tube course actually, video #8, sub-playbooks. This runs flawlessly in the playbook page but when I run it from an incident it ends up trying to reset the password for every AD user even though I specify james.bond as the user. I am not sure of the logic. It doesn't seem to "call" the playbook from the incident, it's almost as though it's a "copy" and so has it's own settings and not those in the playbook? I'll add a screenshot to show what I mean. So I hard-code james.bond in the playbook, save the playbook, call the playbook from an incident and it proceeds to lookup ALL users in AD? What am I missing??!

Thanks,

 

Geoff

1 accepted solution

Accepted Solutions

L4 Transporter

Hi @GWynn, Are you saying that its still passing more that 1 user to the ad-reset-password command? I think there might be some extra information in your context, I thought the DeleteContex might help. Keep at it and it should work. Maybe try re-creating the playbook 1 step at a time. Add print task to output context keys before passing them to the next task. Validate if the value in the print task matches your expectation for the next task input.

 

For manual input, you can leave a mandatory field blank. It will halt the playbook process and allow you to enter the value

In the screenshot below, delete the value of username field in the ad-set-new-password task(1). Run the playbook, wait for it task to fail (2). Open the failed task, add the new run-time value (3) and click "Run automation now"(4).

Screenshot 2023-08-25 at 12.10.51 am.png

 

Another, more complex method is to implement a Data Collection task.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Create...

View solution in original post

13 REPLIES 13

L4 Transporter

Hi @GWynn, Need to see what the actual command looks like. Can you send the full command with its passed parameters?

 

Screenshot 2023-08-22 at 4.14.57 pm.png

GWynn_0-1692688475161.png

Hello @jfernandes1 As shown here it tries to reset the password for everyone, which fails! How do I specify just james?

Here is a screenshot of the sub-playbook with some skipped tasks, but when I run from the incident it STILL runs these??! What am I missing?! Yes I am saving when I make these changes.

GWynn_2-1692705825309.png

 

L4 Transporter

Hi @GWynn, the task skip button only works during the playbook debug process. The task will be included when run in an incident. 

 

Looking at the command input, it looks like your passing all the user names to the command. So it working as expected. There must be something wrong with the input.

 

Check the playbook task input, you can set it like below, where the value is hardcoded. 

Screenshot 2023-08-23 at 2.20.02 pm.png

 

Or you can set it like below, where the value is grabbed from the context. Remember, the playbook debugger uses a different context than the incident so you might experience different behaviours. You can select an existing incident or choose a new mock incident. 

Screenshot 2023-08-23 at 2.25.53 pm.png

When you use this method, if the previous command (AD Get User) returned more than 1 result or the playbook was run multiple times it could pass more usernames. You can check value by copying ${ActiveDirectory.Users.sAMAccountName} to the Context Data search. Like below.

Screenshot 2023-08-23 at 2.31.35 pm.png

 

Added the !DeleteContext all=true task to the start of your playbook is a good way to ensure that playbooks work as designed.

Hello @jfernandes1 thanks for this, I have managed to add in the !DeleteContext all=true command at the start but I am manually inputting the user everywhere I can see! It still won't seem to work, which of course defies logic. I will have another look but it's a small playbook!

GWynn_0-1692771814037.pngGWynn_1-1692771844846.png

GWynn_2-1692771898431.png

Error!

GWynn_3-1692772010208.png

And results:

GWynn_4-1692772037831.png

 

You can see here, in the sub-playbook it is all manually inputted apart from the expire password task. So... it still tried to reset all users passwords!!

L4 Transporter

Hi @GWynn Send me the playbook, I'll test and make the correction. 

Hello @jfernandes1 here are the files. Thanks so much for doing this, sorry to be a pain, I am trying to learn this stuff! Cheers,

 

Geoff

Hello @jfernandes1  I think I have solved the problem. In the playbook when you override the input it must only be for de-bugging the playbook not for the actual incident! Same thing as the break-point. It only works in debugging mode.

GWynn_0-1692859725225.png

 

L4 Transporter

HI @GWynn, Only a slight modification was required. Try and let me know if they work.

My use of the "FirstArrayElement" transformer as an example. Its not required for this case. I think you need to search AD for username to ensure only 1 result is returned since a email address might be associated to more than one account.


I tested the playbook with the debugger and in a fresh incident. Works in both cases.

 

Hello @jfernandes1 thanks for this, yes seems to work but then resets all my users passwords which is "ok" but not ideal! I will play and see if I can somehow prompt for the username to be used/reset. Thanks!! It gets complicated!

L4 Transporter

Hi @GWynn, Are you saying that its still passing more that 1 user to the ad-reset-password command? I think there might be some extra information in your context, I thought the DeleteContex might help. Keep at it and it should work. Maybe try re-creating the playbook 1 step at a time. Add print task to output context keys before passing them to the next task. Validate if the value in the print task matches your expectation for the next task input.

 

For manual input, you can leave a mandatory field blank. It will halt the playbook process and allow you to enter the value

In the screenshot below, delete the value of username field in the ad-set-new-password task(1). Run the playbook, wait for it task to fail (2). Open the failed task, add the new run-time value (3) and click "Run automation now"(4).

Screenshot 2023-08-25 at 12.10.51 am.png

 

Another, more complex method is to implement a Data Collection task.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Create...

Hello @jfernandes1 thanks again for this, I'll keep tweaking it until I get it right! Thanks so much for your help. Cheers,

 

Geoff

  • 1 accepted solution
  • 1756 Views
  • 13 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!