Playbooks seems never end

[SergioPalacios]

Hello everyone

Recently I am developing playbooks for the management of possible security incidents.

Something that catches my attention is that, in case of errors throughout the playbook, I have established that the case is closed through the "Close Investigation (builtin)" automation. Although on other occasions, the question I want to ask also comes from situations in which I manually close a case before the playbook reaches the last point.

In these situations, I always see that the "runStatus" of the previously commented cases is "idle" and not something similar to "Completed" (and also, visually it seems that the playbook continues trying to execute the last task in which it was left when the case was closed). Do playbooks in "idle" state consume resources? How could you improve the transition from these states to a "completed" or "failed" state?

[amontminy · Accepted solution]

The runStatus itself is referring to the playbook within the incident rather than the incident itself. Those statuses don't take up an additional resources than a completed runStatus. One option to have the runStatus show as completed is add some logic to the playbook where it stops for a task that requires user input at the step where you might manually close the case. Based on that input, the playbook could follow an alternate path where the playbook completes without running the additional automated tasks if it were to stay open. The other option would be to create a post process script that checks if all the tasks are completed. If they aren't then the script would prevent the incident from closing.