Execution Results

Check execution status and execution results of playbooks.

After a security playbook executes, you can view the execution results and pending actions on the Execution Results tab.

The following table outlines the actions available on the Execution Results tab.

Action

Description

Filter executed playbook data

Use the Search field and drop-down lists to locate specific task data.

  • Type: The current status of the executed playbook

    Possible execution types include:

    • Pending approval () (if applicable): Some actions in a playbook are waiting for approval to be performed

    • In progress... (): The playbook is being executed

    • Successful (): The playbook was executed successfully

    • Partially successful (): Some of the response actions in the playbook were executed successfully

    • Unsuccessful (): An error or time-out occurred when executing the playbook, or any pending approval was not handled within 24 hours of the current execution

    • Queued (): The playbook was queued

  • Created: The time when the playbook was created

  • Search: Provides partial matching for the Execution ID and Playbook name objects

Approve or reject pending actions of a template-based playbook

Click the number under Actions required to approve or reject pending actions in the playbook.

Note:

Pending actions expire and playbook execution fails if the actions are not manually handled within 24 hours of executing a playbook.

View execution details of a user-defined playbook

Click the execution ID to view detailed information about the playbook execution, including the active statuses of each action configured in the playbook.

All successfully executed nodes are marked green, partially successful nodes are marked orange, and unsuccessful nodes are marked red.

  • To view the execution details of each action, click Check details in the Actions section.

    On the Details screen:

    • To filter action data, use the Search field and Status drop-down list to locate specific action data.

    • To approve or reject all pending actions, click Approve/Reject > Approve All Pending or Approve/Reject > Reject All Pending.

    • To approve or reject some of the pending actions, select the required Pending approval actions and click Approve Selected or Reject Selected.

    Note:

    Pending actions expire and playbook execution fails if the actions are not manually handled within 24 hours of executing a playbook.

  • To download the generated CSV file, click Download file in the Actions section.

Edit the playbook

Click the Edit playbook icon () to edit the playbook.