Views:

View the details of a playbook execution.

In the Execution Results tab of Security Playbooks, clicking an execution ID provides details about the playbook execution and a visual representation of the playbook configuration.
The Execution Details section consists of the Workbench alert that triggered the playbook, the current status of the execution, the time and date when the execution was last updated, and a summary of the triggered action nodes.
There are six possible action node statuses:
  • Pending approval (pending_approval=7ad48a47-cb38-4fff-9dee-cceb77d9c5c1.png): Actions require approval to be performed
    Note
    Note
    Pending actions expire if not approved within 24 hours of executing a playbook.
  • In progress... (in_progress=51020eba-8ed4-4fca-9bdd-73158770bb4d.png): Actions executing
  • Successful (successful=9cb8192f-f627-4fa2-b6dc-f77c09ac5d18.png): Actions executed successfully
  • Partially successful (partially_successful=20230317094545.png): Some actions executed successfully
  • Unsuccessful (unsuccessful=78851f4e-24ea-4fde-bbe4-370e3d55f811.png): An error occurred executing actions or pending approvals were not handled within 24 hours of executing the playbook
  • Queued (queued=3df61664-4178-4a69-91d6-3d269379ee0c.png): Actions queued
The Action section provides a hierarchical list of the action nodes that were triggered and their current status. The following table outlines the actions available within the section.
Action
Description
Focus on a node
Click an action node in the list to focus the playbook visualization on the selected node.
Refresh the list
Click the Refresh list icon (refresh_list=D76B2D4B-215D-4020-8E9E-1350944BD0D5.png) to update the status of all listed action nodes.
Examine an action node
Click Check details to open the Action Details screen, which tallies and lists the status for each target of the selected node.
Note
Note
Check details is only displayed if the selected node is configured to execute actions on targets.
Download a CSV file
Click Download file to download a CSV detailing the results of the playbook execution up to the selected node.
Note
Note
Download file is only displayed if the selected node is configured to generate a CSV file.