Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Playbooks seems never end

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Playbooks seems never end

L1 Bithead

Hello everyone

 

Recently I am developing playbooks for the management of possible security incidents.

 

Something that catches my attention is that, in case of errors throughout the playbook, I have established that the case is closed through the "Close Investigation (builtin)" automation. Although on other occasions, the question I want to ask also comes from situations in which I manually close a case before the playbook reaches the last point.

 

In these situations, I always see that the "runStatus" of the previously commented cases is "idle" and not something similar to "Completed" (and also, visually it seems that the playbook continues trying to execute the last task in which it was left when the case was closed). Do playbooks in "idle" state consume resources? How could you improve the transition from these states to a "completed" or "failed" state?

1 accepted solution

Accepted Solutions

L3 Networker

The runStatus itself is referring to the playbook within the incident rather than the incident itself. Those statuses don't take up an additional resources than a completed runStatus. One option to have the runStatus show as completed is add some logic to the playbook where it stops for a task that requires user input at the step where you might manually close the case. Based on that input, the playbook could follow an alternate path where the playbook completes without running the additional automated tasks if it were to stay open. The other option would be to create a post process script that checks if all the tasks are completed. If they aren't then the script would prevent the incident from closing.

View solution in original post

1 REPLY 1

L3 Networker

The runStatus itself is referring to the playbook within the incident rather than the incident itself. Those statuses don't take up an additional resources than a completed runStatus. One option to have the runStatus show as completed is add some logic to the playbook where it stops for a task that requires user input at the step where you might manually close the case. Based on that input, the playbook could follow an alternate path where the playbook completes without running the additional automated tasks if it were to stay open. The other option would be to create a post process script that checks if all the tasks are completed. If they aren't then the script would prevent the incident from closing.

  • 1 accepted solution
  • 1306 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!