Splunk SOAR (f.k.a. Phantom)

Playbook multiple run on the same event

crayford
Explorer

I am noticing for some of our events our playbooks run multiple times on the same event. How can I go about keeping that from happening? The second run of the playbook is generating a lot of error notifications for us.

Ex

We get an alert, Phantom ingest the email, our move processed email playbook runs, our alert playbooks run and then our move processed email playbook runs again causing us to receive an error notification (by design). How can this be stopped?

Labels (2)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@crayford this issue is usually down to child-playbooks adding artifacts to the container with `run_automation` flag set to True. This will mean any Active playbooks will be re-initiated. 

Check your child playbooks for any artifact creation and make sure they have the `run_automation` flag set to false. This can be set in both REST and the Phantom Phantom app with the add_artifact action. 

Other issues may be when you ingest emails that it adds new artifacts to existing playbooks too. 

One quick fix is to add a tag to the container when it's finished processing the 1st time and then have a decision in the Active playbook to check for that tag and END if it's there. 

View solution in original post

phanTom
SplunkTrust
SplunkTrust

@crayford this issue is usually down to child-playbooks adding artifacts to the container with `run_automation` flag set to True. This will mean any Active playbooks will be re-initiated. 

Check your child playbooks for any artifact creation and make sure they have the `run_automation` flag set to false. This can be set in both REST and the Phantom Phantom app with the add_artifact action. 

Other issues may be when you ingest emails that it adds new artifacts to existing playbooks too. 

One quick fix is to add a tag to the container when it's finished processing the 1st time and then have a decision in the Active playbook to check for that tag and END if it's there. 

crayford
Explorer

@phanTom Thank you for the tips! I went ahead and changed the run_automation flag to false and I added the tag to the move email playbook. 

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...