IBM QRadar SOAR

That seems like a task pending to be closed/completed. Can you mark it as complete? You should see the playbook end.

Hi Matteo, from what I see your playbook only has one "manual task", if I remember correctly the manual task needs to be check as completed by a person to be considered done.

In other words the playbook it's waiting for someone to see the task, read the instructions and execute what needs to be executed manually and then check saying "I've done it", then the playbook will continue their process.

If you want to automatically close tasks then you'll need to use something like Custom Tasks and this app:

https://ibmresilient.github.io/resilient-community-apps/fn_task_utils/README.html

Best regards

Hello Matteto.

I guess that it's your first step to the SOAR playbook. You can try the following:

1. Open the incident you're running the playbook with
2. Locate tasks tab. (Then you'll see the task "Initial Triage" and it has a circle with unchecked, I guess)
3. Check the circle. (The word "Initial Triage" goes to strike-through.)
4. Check your running playbook again.