topic Re: Running a playbook without Event id? in Splunk SOAR

Running a playbook without Event id?

ansir — Mon, 16 Jan 2023 13:27:14 GMT

Hi,

i'm trying to create a set of playbooks to unit test other playbooks.

is it possible to run a playbook without providing an event id?

thanks.

Ansir

Re: Running a playbook without Event id?

phanTom — Mon, 16 Jan 2023 13:30:04 GMT

@ansir a playbook must have either a container id or artifact id to run against.

You can have an empty event generated by a timer app which will kick a playbook (set to active) off then you could populate the event before running through the playbook(s) you are wanting to test!

Hope this helps! Happy SOARing!