Subplaybook execution count

[Antanas]

Hi!

Is there a way to count how many times was the specific subplaybook executed across mutliple/all incidents? How to ensure the number includes loops in subplaybooks?

The reason I need this number is to better understand ROI of the platform.

Thanks

[nkazinets · Accepted solution]

Hey @Antanas,

You can create a widget where the data source is "SOAR Metrics", and query on that playbook.

In the following example, I'm checking how many times were any playbooks that contain the word "Phishing" in their name were executed in the past month:

Each time a playbook loops it's considered as an execution (so looping 5 times in an incident will add 5 to the execution count).