Audit Log Review

[adem_netsys]

Hi,

We would like to obtain an output detailing what playbooks users are running on SOAR and the operations they perform. Can we achieve this using audit logs, or do you have any existing playbooks or similar tools for this purpose?

[Echumba]

Hi Adem,

Fortisoar keeps audit logs for all actions with fortisoar. You can get user specific playbook related actions under > Settings>Audit Logs. Filter as per your requirement, in this case playbooks.

[adem_netsys]

Can I use this in the playbook?

[Echumba]

Yes, is possible. What exactly is your objective, Fortisoar already has a audit log module. 

If you intend to develop a playbook, here is the logic;

Triger=On Playbook Execution> Fetch execution details using custom code snippet>Send to mail or store in a module.