IBM Security QRadar SOAR

 View Only
  • 1.  Waiting for automation playbook

    Posted 29 days ago

    I have issues with playbook process, i can't close playbook because i don't no when playbook automation with object assign artifact away run. I can't follow when all playbooks automation in an incident have done yet. Because i want close when all playbook automation with object assign artifact have done.



    ------------------------------
    Dũng Đặng
    ------------------------------


  • 2.  RE: Waiting for automation playbook

    Posted 26 days ago

    Hi Dũng,

    This is possible via a couple of integrations. The app and function: fn_playbook_utils.pb_get_playbook_data will provide status on all playbooks run for an incident. From the list returned, it should be possible to confirm that all are in the 'completed' or 'error' state.

    The fn_scheduler app can be used to periodically run a playbook to get this data and then close the incident when all are complete. Be sure to filter out the current scheduler playbook as that playbook will always be in the 'running' state.

    I hope this helps. 

    Regards,



    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: Waiting for automation playbook

    Posted 24 days ago
    Edited by Dũng Đặng 24 days ago

    Hello Mark Scherfling,

    Thank you for your quick answer !

    Is there any other way that I can integrate in the playbook corresponding to the incident without needing the fn_scheduler app? My purpose is to monitor the playbook automation assigned to artifacts in the incident. After those playbook automations have finished running, I will close incident.

    Regards



    ------------------------------
    Dũng Đặng
    ------------------------------



  • 4.  RE: Waiting for automation playbook

    Posted 24 days ago

    Hi Dũng,

    I'm not aware of another way to automate this at the moment. You can modify your playbook for artifact enrichment to check all other playbooks for completion. If none are active, you can close the incident. There is a race condition here. If a playbook hasn't yet triggered for a different artifact, the playbook could close the incident pre-maturely. 

    Sorry for not having another solution.

    Regards,

    Mark



    ------------------------------
    Mark Scherfling
    ------------------------------



  • 5.  RE: Waiting for automation playbook

    Posted 22 days ago

    Hello Mark Scherfling,

    Thanks you for answer, i will try to solve this problem.



    ------------------------------
    Dũng Đặng
    ------------------------------