Why can't I run created playbooks on Alerts/Incidents?

Forum|Forum|1 year ago
September 21, 2024
2 replies
1200 views

Hello Community.

I'm trying to run some newly created playbooks with Manual Trigger using csadmin user, then I want to run it on ingested alerts from SIEM or escalated alerts (incidents) using the Execute option at the bottom of each record, but I can't see the playbooks that I want to run. Why is this happening?

Regards!

Best answer by ranjeet

Hi @gwaihir ,

First, ensure that the playbook is in an active state.

PB Active State.PNG

Make sure that the Trigger Button Label is not empty. If you want to run the playbook on an alert, select the alert in the "Execution Behaviour" settings.

Trigger Button.PNG

After setting the trigger point, go to alerts and refresh the FortiSOAR webpage. Then, select an alert and click on "Execute". You should see the Trigger Button Label you set in the trigger point, along with the playbook collection name where the playbook is located.

Execute From Alert.PNG

If you need assistance or more details, feel free to reach out to me at ranjeet.nagane@spryiq.co or swapnil@spryiq.co.

ranjeetAnswer

Explorer

Hi @gwaihir ,

First, ensure that the playbook is in an active state.

PB Active State.PNG

Make sure that the Trigger Button Label is not empty. If you want to run the playbook on an alert, select the alert in the "Execution Behaviour" settings.

Trigger Button.PNG

After setting the trigger point, go to alerts and refresh the FortiSOAR webpage. Then, select an alert and click on "Execute". You should see the Trigger Button Label you set in the trigger point, along with the playbook collection name where the playbook is located.

Execute From Alert.PNG

If you need assistance or more details, feel free to reach out to me at ranjeet.nagane@spryiq.co or swapnil@spryiq.co.