IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Playbook Designer End Point Best Practices

  • 1.  Playbook Designer End Point Best Practices

    IBM Champion
    Posted Tue August 09, 2022 12:56 PM

    All,

    I'm confused about using multiple end points vs using a wait point and a single endpoint.

    Are either of the designs below better than the other?





    I haven't tested this but I'm wondering if anyone knows if they'd behave differently if one of those scripts raised an exception. I'm wondering if that exception would cause the wait point to prevent the playbook from finishing where as if the playbook had two end points, if that exception would count as a finished path, allowing the playbook to finish.

    Please let me know what you think.

    Thanks,


    ------------------------------
    Liam Mahoney
    ------------------------------


  • 2.  RE: Playbook Designer End Point Best Practices

    Posted Fri September 02, 2022 02:47 AM
    Our workflow engine will complete the playbook util ALL the branches are completed, and if there is an error the whole playbook is failed. So there is no difference in both your cases. The playbook will be terminated with error on both cases if one of the script is failed.

    ------------------------------
    Gilbert Liao
    ------------------------------