Playbook multiple run on the same event

[crayford]

I am noticing for some of our events our playbooks run multiple times on the same event. How can I go about keeping that from happening? The second run of the playbook is generating a lot of error notifications for us.

Ex

We get an alert, Phantom ingest the email, our move processed email playbook runs, our alert playbooks run and then our move processed email playbook runs again causing us to receive an error notification (by design). How can this be stopped?

[phanTom · Accepted solution]

@crayford this issue is usually down to child-playbooks adding artifacts to the container with `run_automation` flag set to True. This will mean any Active playbooks will be re-initiated. 

Check your child playbooks for any artifact creation and make sure they have the `run_automation` flag set to false. This can be set in both REST and the Phantom Phantom app with the add_artifact action. 

Other issues may be when you ingest emails that it adds new artifacts to existing playbooks too. 

One quick fix is to add a tag to the container when it's finished processing the 1st time and then have a decision in the Active playbook to check for that tag and END if it's there. 

[crayford]

@phanTom Thank you for the tips! I went ahead and changed the run_automation flag to false and I added the tag to the move email playbook.