Playbook Executions
There are two ways to view the history of a playbook’s executions: through the Executions overview tab, and from a specific playbook’s details page.
Note
The previous History tab is now named the Executions tab.
Playbook Executions Overview ⫘
The Executions tab displays all executed playbooks.
Tip
Use one or more filters above the table and the State column to quickly identify executions in various states.
Playbooks Executions Tab
Playbook History ⫘
Playbook details pages feature a History table displaying all executions of the playbook.
Tip
Select one or more filters above the table to quickly identify executions in various states.
Possible playbook states include:
- Completed — The playbook executed without any errors
- Failed — The playbook failed to complete because of an error
- Started — The playbook is currently running
- Timed Out — The playbook either took over 1 hour for a single step to complete, or the entire playbook exceeded the maximum timeout threshold (24 hours)
- Canceled — The playbook was manually canceled before it finished running
History of a Playbook
Friendly History Field Names ⫘
Automation and APIs play a crucial role in the Taegis platform by streamlining processes and eliminating repetitive tasks.
When records are modified within the Taegis platform by configured Automation playbooks rather than a logged-in user, the change details are captured as friendly identity names in the Created By and Updated By fields to represent Automation actions.
Specific names are used for various platform actions:
-
Automatic Investigation: These are investigations created by or appended to by the Auto-Investigation engine. They can result from rules executed by a provider on behalf of their sub-tenants or within each tenant based on tenant-level rules.
-
Automatic Evidence Sync: This label applies whenever the platform bulk-appends alert and event data to an investigation.
-
Automation: Refers to changes made by playbooks and connectors running within the Taegis platform.
-
ManagedXDR: Encompasses automation and scripting leveraged in the delivery of our ManagedXDR services.
View Playbook Executions and Failures ⫘
Drilling Down into a Failed Playbook
Open a playbook to view a history of its Executions and Failures in a bar graph. Adjust the time frame as needed.
Below the Executions and Failures graph is a Playbook History table, which lists a full record of the playbook’s past executions. Select the start time of one of these executions to view a JSON of the inputs and outputs of a specific playbook execution when drilling down into its details. On the same view, there is a link to the Target Resource where applicable. This view may help you drill down into individual steps and identify where a playbook failed to execute.
Cancel Playbook Executions ⫘
To cancel individual instances of a playbook’s execution, follow these steps.
- From the Playbooks Executions tab or a playbook’s History table, select the executions you would like to cancel using the checkboxes to the left.
- Select Actions and choose Cancel Selected Executions.
- Select Proceed to confirm your action and cancel the executions.
Cancel Playbook Executions
Tip
To cancel ALL running executions for a single configured playbook, see Cancel Executions of a Playbook.
Re-Execute a Playbook Execution ⫘
Re-Run a Playbook
If you wish to re-run an execution (for example, because it failed), follow these steps:
- From the Playbooks Executions tab or a playbook's History table, select the execution(s) you would like to re-run using the checkboxes to the left.
- Select Actions and choose Re-execute Selected.
Export Playbook Execution History ⫘
There are three ways to export the Playbook Execution History:
- Select Actions > Export All as CSV from the Playbooks Executions tab or a playbook's History table for a CSV of the entire Playbook History.
Export the Entire Playbook History
- Select Actions > Export as JSON for a JSON of the entire playbook that ran.
Export the Playbook
- Select the Export icon for a JSON of an individual playbook step.
Export a Playbook Step
Share Playbook Execution ⫘
To share a specific playbook execution, select the copy share link icon from playbook execution details:
Share a Playbook Execution
View Playbook Execution in CEL Explorer ⫘
From the Actions menu, select View in CEL Explorer to test the outcome of CEL expressions against the data being viewed for use in Automations configurations. For more information, see CEL Explorer.
View Playbook Execution in CEL Explorer