FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
premchanderr
Staff
Staff
Article Id 334582
Description

 

This article describes the key points to note for preventing playbooks from going to the Incipient state.

 

Scope

 

FortiSOAR 6.0+.

 

Solution

 

The Incipient status of the playbook would occur if the previous playbook is still active. 

 

Here are a few scenarios:

  • Parallel execution is disabled where there is a limit of one active instance at a time for playbook execution.
  • Consider a playbook already active and still running. Now if another playbook starts as per schedule, then it would go to Incipient state and not run. Finally, again the playbook runs as per the set schedule (5min, 10min, etc).

 

To avoid this state increase the time between playbook schedules and ensure system resources are optimally used with no high processes.

 

In recent versions, the playbook in the incipient state would be terminated and run on the next schedule.
For FortiSOAR Pre-7.4.1, it could be necessary to manually 'Kill the incipient status instances' if there is no active playbook, and then the schedule continues running.