https://community.splunk.com/t5/Splunk-SOAR/Disable-Active-Playbook-from-Automatically-Running-When-Artifact/m-p/538573#M560 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/230990">@stauff</a>&nbsp;there are a few ways to stop this, my main preference is only adding artifacts via methods where you can stipulate run_automation = False. The 3 ways this is possible at the moment are:</P><UL><LI>REST Call to add artifact and set run_automation to False <A href="https://docs.splunk.com/Documentation/Phantom/4.10.1/PlatformAPI/RESTArtifacts#.2Frest.2Fartifact" target="_self">Artifact REST Docs</A>&nbsp;</LI><LI>Use the Phantom Phantom app's add_artifact call and untick the run_automation option</LI><LI>Use the extract_ioc action in the Parser app and untick the run_automation&nbsp;</LI></UL><P>The issue is that if you add manually to a container then it will NOT provide this option so in this case it would be best to add a tag to the event to state it's been "processed" already and then have a decision at the beginning that looks for that tag and ends if it exists. This can get messy in the activity pane if you are adding a lot manually but will work.&nbsp;<BR /><BR />Personally I would recommend controlling the addition of artifacts by a playbook, maybe with a prompt for artifact info and then use REST or the add_artifact to add the data with the run_automation set to False.&nbsp;<BR /><BR />Hope this helped? If so please upvote.</P> Thu, 04 Feb 2021 09:25:33 GMT phanTom 2021-02-04T09:25:33Z https://community.splunk.com/t5/Splunk-SOAR/Disable-Active-Playbook-from-Automatically-Running-When-Artifact/m-p/538537#M559 <P>Hello All!&nbsp; I'm trying to figure out how to stop an active playbook from auto running when an artifact is added to a case via the GUI.&nbsp; I can't seem to find any documentation or option to turn this functionality off.&nbsp; Is there a setting for this?&nbsp; Or do I need to add logic to my playbook so it cancels itself if it has already been run on the current container?</P> Thu, 04 Feb 2021 00:22:43 GMT https://community.splunk.com/t5/Splunk-SOAR/Disable-Active-Playbook-from-Automatically-Running-When-Artifact/m-p/538537#M559 stauff 2021-02-04T00:22:43Z https://community.splunk.com/t5/Splunk-SOAR/Disable-Active-Playbook-from-Automatically-Running-When-Artifact/m-p/538573#M560 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/230990">@stauff</a>&nbsp;there are a few ways to stop this, my main preference is only adding artifacts via methods where you can stipulate run_automation = False. The 3 ways this is possible at the moment are:</P><UL><LI>REST Call to add artifact and set run_automation to False <A href="https://docs.splunk.com/Documentation/Phantom/4.10.1/PlatformAPI/RESTArtifacts#.2Frest.2Fartifact" target="_self">Artifact REST Docs</A>&nbsp;</LI><LI>Use the Phantom Phantom app's add_artifact call and untick the run_automation option</LI><LI>Use the extract_ioc action in the Parser app and untick the run_automation&nbsp;</LI></UL><P>The issue is that if you add manually to a container then it will NOT provide this option so in this case it would be best to add a tag to the event to state it's been "processed" already and then have a decision at the beginning that looks for that tag and ends if it exists. This can get messy in the activity pane if you are adding a lot manually but will work.&nbsp;<BR /><BR />Personally I would recommend controlling the addition of artifacts by a playbook, maybe with a prompt for artifact info and then use REST or the add_artifact to add the data with the run_automation set to False.&nbsp;<BR /><BR />Hope this helped? If so please upvote.</P> Thu, 04 Feb 2021 09:25:33 GMT https://community.splunk.com/t5/Splunk-SOAR/Disable-Active-Playbook-from-Automatically-Running-When-Artifact/m-p/538573#M560 phanTom 2021-02-04T09:25:33Z