- Get Started with Threat Center
- Group Detections
- Work on Cases
- Work on Alerts
- Edit and Collaborate in Threat Center
- Use Automation Tools in Threat Center
- Find Cases or Alerts
- Build a Search in Threat Center
- Enter a Search Using Exabeam Query Language in Threat Center
- Enter a Search Using Natural Language in Threat Center
- Run a Recent Search in Threat Center
- Create a New Saved Search in Threat Center
- Run a Saved Search in Threat Center
- Edit a Saved Search in Threat Center
- Delete a Saved Search in Threat Center
- Sort Cases or Alerts
- View Case and Alert Metrics
- Get Notified About Threat Center
View Case or Alert Automation History
View all playbooks and actions manually run on a case or alert.
In a case or alert, navigate to the Automation tab.
View every playbook and action run on the case or alert, including:
The date and time the playbook or action was run.
Who ran the playbook or action. If the playbook was automatically triggered, Automation is listed.
The name of the playbook or action.
Whether the run was a success or failure.
To view more details about a run, select the run. View whether the run was a success or failure and how long it took to run the playbook or action.
Under the Graph tab, view the playbook itself, which steps were executed, and how long it took to execute a step.
Under the Details tab, review each executed step, including the result of each step, how long each step took to run, and the step log.
Filter Case or Alert Automation History
Quickly find a specific instance of when a playbook or action was run on a case or alert.
You can filter by:
Playbook/Action – Playbook or action name
Type – Advanced playbook, rule-based playbook, or action
User/Actor – Who ran the playbook or action
Outcome – Success or failed
Click a filter, then from the list, select the attributes relevant to the instance you're finding.