IBM Security QRadar SOAR

 View Only
  • 1.  Playbook progress status

    Posted Fri September 03, 2021 07:49 AM
    I'm just working around playbook designer.

    Then I could see all the Playbook progress status except "Suspended". So I'm curious how we go into "Suspended" status. May I have the use case?

    Running: just playbook stays in the middle such as task completion is being waited.
    Error: Playbook failed to get the return from Function processor.
    Completed: Playbook normally reached endpoint.
    Canceled: Running playbook was cancelled by X icon.


    ------------------------------
    Yohji Amano
    ------------------------------


  • 2.  RE: Playbook progress status

    Posted Tue September 07, 2021 09:46 AM
    When an Incident is closed and the Playbook is still running, the Playbook goes into the Suspended status. If the closed Incident is opened then any Suspended Playbooks go into the Running status.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: Playbook progress status

    Posted Tue September 07, 2021 08:30 PM
    Ben, thank you very much.

    As you said, I could see "Suspended" state when intentionally activating a playbook on a closed incident .
    In addition I could see the state change from "Suspend" to "Running" when I reopen the incident.

    ------------------------------
    Yohji Amano
    ------------------------------