Skip to main content

Threat CenterThreat Center Guide

View Case or Alert Automation History

View all playbooks and actions manually run on a case or alert.

  1. In a case or alert, navigate to the Automation tab.

  2. View every playbook and action run on the case or alert, including:

    • The date and time the playbook or action was run.

    • Who ran the playbook or action. If the playbook was automatically triggered, Automation is listed.

    • The name of the playbook or action.

    • Whether the run was a success or failure.

  3. To view more details about a run, select the run. View whether the run was a success or failure and how long it took to run the playbook or action.

    Under the Graph tab, view the playbook itself, which steps were executed, and how long it took to execute a step.

    Under the Details tab, review each executed step, including the result of each step, how long each step took to run, and the step log.

Filter Case or Alert Automation History

Quickly find a specific instance of when a playbook or action was run on a case or alert.

You can filter by:

  • Playbook/Action – Playbook or action name

  • Type – Advanced playbook, rule-based playbook, or action

  • User/Actor – Who ran the playbook or action

  • Outcome – Success or failed

Click a filter, then from the list, select the attributes relevant to the instance you're finding.