- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
07-21-2023 12:14 AM
Hello everyone
Recently I am developing playbooks for the management of possible security incidents.
Something that catches my attention is that, in case of errors throughout the playbook, I have established that the case is closed through the "Close Investigation (builtin)" automation. Although on other occasions, the question I want to ask also comes from situations in which I manually close a case before the playbook reaches the last point.
In these situations, I always see that the "runStatus" of the previously commented cases is "idle" and not something similar to "Completed" (and also, visually it seems that the playbook continues trying to execute the last task in which it was left when the case was closed). Do playbooks in "idle" state consume resources? How could you improve the transition from these states to a "completed" or "failed" state?
07-21-2023 11:14 AM
The runStatus itself is referring to the playbook within the incident rather than the incident itself. Those statuses don't take up an additional resources than a completed runStatus. One option to have the runStatus show as completed is add some logic to the playbook where it stops for a task that requires user input at the step where you might manually close the case. Based on that input, the playbook could follow an alternate path where the playbook completes without running the additional automated tasks if it were to stay open. The other option would be to create a post process script that checks if all the tasks are completed. If they aren't then the script would prevent the incident from closing.
07-21-2023 11:14 AM
The runStatus itself is referring to the playbook within the incident rather than the incident itself. Those statuses don't take up an additional resources than a completed runStatus. One option to have the runStatus show as completed is add some logic to the playbook where it stops for a task that requires user input at the step where you might manually close the case. Based on that input, the playbook could follow an alternate path where the playbook completes without running the additional automated tasks if it were to stay open. The other option would be to create a post process script that checks if all the tasks are completed. If they aren't then the script would prevent the incident from closing.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!