topic Re: playbook id changes all the time in Splunk SOAR

playbook id changes all the time

meshorer — Mon, 23 Oct 2023 13:46:40 GMT

hi,

I see that playbooks ID keep changing all the time.

can anyone explain the reasons to it?

thank you,

Daniel

Re: playbook id changes all the time

phanTom — Mon, 23 Oct 2023 13:49:10 GMT

@meshorer whenever you update a playbook it will save with a different id to enable version control.

Is something about it changing the id causing you some issues in automation (or other places)?

Re: playbook id changes all the time

meshorer — Mon, 23 Oct 2023 15:00:15 GMT

@phanTom , thank you.

it is a bit difficult to keep track all the ID's, but I learned there is a rest query to get the name of the playbook from it's ID.

Re: playbook id changes all the time

phanTom — Mon, 23 Oct 2023 15:23:19 GMT

@meshorer Understood but I am just wondering that you mean by tracking as the system "tracks" them.

Yes there is a rest call to find the name based on the id:

xxx/rest/playbook/<id>/name

If you need to find an ID based on the name then you can also:

xxx/rest/playbook?_filter_name="<name>"

-- Happy SOARing! Please mark as a solution for future readers if it resolved your issue. --

Re: playbook id changes all the time

meshorer — Mon, 23 Oct 2023 15:28:11 GMT

"tracks" meaning that I plan to monitor logs to fire an alert when for example a playbook fails to execute.
in that case, I would probably need to identify which is the failing playbook by it's ID.

I have posted a new question about it 🙂

thank you