Splunk SOAR (f.k.a. Phantom)

Playbook multiple run on the same event

crayford
Explorer

I am noticing for some of our events our playbooks run multiple times on the same event. How can I go about keeping that from happening? The second run of the playbook is generating a lot of error notifications for us.

Ex

We get an alert, Phantom ingest the email, our move processed email playbook runs, our alert playbooks run and then our move processed email playbook runs again causing us to receive an error notification (by design). How can this be stopped?

Labels (2)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@crayford this issue is usually down to child-playbooks adding artifacts to the container with `run_automation` flag set to True. This will mean any Active playbooks will be re-initiated. 

Check your child playbooks for any artifact creation and make sure they have the `run_automation` flag set to false. This can be set in both REST and the Phantom Phantom app with the add_artifact action. 

Other issues may be when you ingest emails that it adds new artifacts to existing playbooks too. 

One quick fix is to add a tag to the container when it's finished processing the 1st time and then have a decision in the Active playbook to check for that tag and END if it's there. 

View solution in original post

phanTom
SplunkTrust
SplunkTrust

@crayford this issue is usually down to child-playbooks adding artifacts to the container with `run_automation` flag set to True. This will mean any Active playbooks will be re-initiated. 

Check your child playbooks for any artifact creation and make sure they have the `run_automation` flag set to false. This can be set in both REST and the Phantom Phantom app with the add_artifact action. 

Other issues may be when you ingest emails that it adds new artifacts to existing playbooks too. 

One quick fix is to add a tag to the container when it's finished processing the 1st time and then have a decision in the Active playbook to check for that tag and END if it's there. 

crayford
Explorer

@phanTom Thank you for the tips! I went ahead and changed the run_automation flag to false and I added the tag to the move email playbook. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...