Playbook Variable

[adem_netsys]

Hi guys,

How can I use the set variable value in a playbook I created in a different playbook?

[Anonymous]

Thanks for reaching out, please help share some more info, so that we can facilitate your ask.

[adem_netsys]

I have one playbook and it has a set variable value in it. I want to use this variable value in different playbooks.

[swolf]

I think you need to expand on the use case. i.e. What's the use case for the playbooks? Why do you need to pass that data stored in the variable into another playbook? 

To my knowledge, the only way that you could use that variable's value in another playbook, is if that playbook then calls another playbook (via referencing), and passes that variable into the referenced playbook.

An alternative is it to pass the value of that variable into a global variable, or to store the data in a custom module, but I probably wouldn't recommend those without knowing the use case.

[adem_netsys]

for example, when an alarm occurs on a device, I assign the alarm id to a varible value and connect to the device with ssh and run a command, and I need to do this in different playbooks, but it doesn't seem practical to add it manually all the time. I also thought about assigning a global value, I was curious about a different method.

[swolf]

The best method would probably be to use the playbook reference method, as detailed by Dylan further down. The workflow would probably be something along the lines of:

1. Alarm fires on device and is sent via some method to the FortiSOAR (SIEM alert, etc)
2. The FortiSOAR creates an Alert based on the ingested alert.
3. A playbook triggers based on the Alert being created (or is manually fired from the Alert by an analyst), which creates the variable to store the info you want to store.
4. The playbook references other playbooks, passing the variable to them, which triggers those playbooks to carry out their specific actions.

If the data in the variable is only linked to that Alert, then another possible way would be to store the information in a field in the Alert. You could use an unused field for that Alert type, or you could modify the Alert module to include a custom field which you use for only that purpose.

[Anonymous]

Thank you so much @swolf and adem_netsys for your prompt reply. 

In addition, please see Playbooks Guide https://docs.fortinet.com/document/fortisoar/7.4.1/playbooks-guide/331279/introduction-to-playbooks#...

Feel free to add on more details and our experts will pitch in.

[dspille · Accepted solution]

Hello Adem_netsys,

The most common way this is done is by adding a parameter to your referenced (child ) playbook via Tools > Parameters.  Then you are able to pass specific variables to that playbook

When you call the child/reference playbook from the parent playbook, you are able to insert variables into the new parameter

Then back in the child playbook you can use the parameter

When we run the playbook we can confirm that the variable was passed.

I've attached this playbook to my comment so feel free to give it a try. Hope this helps!

[adem_netsys]

Hi Dylan,

First of all, thank you very much for your concern. What is the difference between creating a global variable and giving a parameter?

[sjinturkar_FTNT]

As name suggests Global Variable is global at FortiSOAR instance and it will be accessible and used by any playbook in the instance. Whereas parameter is local to that specific PB instance.