In this video, we get to take a look at the use of playbook monitors, which can
help us get a big
picture view of which playbooks have run and how often they have run. So let's
head once again down
to the 40 analyzer and take a look. So here at the 40 analyzer for automation,
once again, we're
going to go to incidents and events. And then below incidents and events, we're
going to go to automation.
So here in automation, we have summary, which is not a bad idea. I was seeing,
you know, how many
playbooks have been executed and how many actions have taken place. And all of
these have been
the last couple of days, while I've been preparing for this skill. And then we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the last couple of days, while I've been preparing for this skill. And then we
have our active connectors,
which is the other devices we can interact with. We have virus total and the v
Sphere connector.
We have 40 OS devices, which is the 48 firewalls. We have the local connector
and also a
Fortigar. If we go to playbooks, here we have our playbooks, including ones
that are built in and
the ones that I created. And then we have the playbook monitor, which is going
to show us
the playbooks. And when they ran, what their triggers were, their start time,
the end time. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the end time.
And I'm going to go ahead and collapse the left hand side gives a little bit
more room.
So if we look at the status of these, we had a lot that were very successful
because it was the same
playbook that was running over and over again, based on various events that
were coming in.
And as a result, it created all those incidents that we were then able to go in
and further run
playbooks on for additional automation. So if we scroll down far enough, we're
going to have
some failed like right here. Look at the timestamps. That's what I was testing
and working through
a few of them. But the cool thing is, if they fail, the log messages can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a few of them. But the cool thing is, if they fail, the log messages can
indicate where it failed.
So if we have a playbook with 15 or 16 tasks and it, you know, two or three of
them failed,
we just go into those specific tasks and tune them up. And also I've learned
that it's a lot better
to take a existing playbook and clone it and tweak it or create a new one from
a template,
because that's going to have a lot of the missing pieces rather than just
creating one from scratch.
So for example, this right here that failed, if we click on this little icon
for detail,
it'll give us the detail regarding that playbook. So it was on demand, which
means we had to click
into launch it. And the so here's the problem. It never generated the report. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
into launch it. And the so here's the problem. It never generated the report.
And as a result,
it never attached that report to the incident. Maybe that report wasn't
available or I'd messed
with it somehow or taken off the caching. I'm not sure. And then even that's
the problem. It
couldn't create the report. So it couldn't attach that report to the incident.
Stick
look at another one scroll down. In fact, let's go to this right here with
double click. And this
is showing us fail. I think I created it or started creating it. And I ran a
test run without all
the details in it. So it did the trigger and then it failed. So for this one, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the details in it. So it did the trigger and then it failed. So for this one,
based on the
timestamp, that was early in the day for me when I started recording or
starting doing some testing.
And I just barely put the trigger in place. And I hadn't put in all the details
. So that's the
best reason this one failed. But most of these have been successful. So here's
one for the vSphere
connector. That's running every 10 minutes, it looks like based on the
scheduling interval.
Fantastic. And I'll make that column a little bit bigger as well. And for the
columns, if we
want to remove some columns, you can use the gear. And we can remove the ones
that we don't need. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we don't need.
For example, start time and time if those aren't too critical, you can remove
them. Or if you want
to put it back to the defaults, just click right here and reset the default. So
again, here at the
summary, you can get a big picture look at like how many playbooks were
executed and how many
actions were executed. And then the playbook monitor is showing us the nitty
gritty details.
And then we can double click or click right here on the details icon to get
more information on
that playbook. And whether or not all of its tasks completed or not. And as one
other example,
I don't think we tested the virus total connector. So let's go to our playbooks WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I don't think we tested the virus total connector. So let's go to our playbooks
. And here's one called
get URL reputation. So we can just go ahead and run it right here. And let's
say for the URL,
we're going to do www.fordnet.com and click on OK. And that should run it.
Because we have a
connector out to virus total, that should succeed. We'll verify that here in
just a moment. And
sure enough, so on demand means we click the button to launch it. It was able
to successfully
get the data. And then this data by itself isn't too helpful unless we also
associate for example, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
associate for example,
with an incident. So what we could do, for example, is take this playbook
called get URL reputation,
clone it, and then we get added on another action. So here I'll call it
attached to incident. And for
the action will attach data to incident. And I just like playbook starter here
and click on OK.
And now it's attached. So we should be able to go to an incident manually run
this playbook.
And it'll go out and it'll gather the information in this case, the reputation
based on the URL
and attach that data to the incident. So we'll click on OK. And we'll go back
to our incidents.
Let's go ahead and grab one. How about this one right here? We'll double click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's go ahead and grab one. How about this one right here? We'll double click
and we'll scroll
down and see what playbooks have already run. So no playbooks yet. We'll click
on execute playbook.
And I think we call it copy of you get URL reputation. So we'll launch that
click on OK.
Oh, and because we just created it, it needs a little bit of time to complete
the parsing. Also,
I didn't specify the URL. So if there's a URL in this incident, perhaps it
would pull that,
but I didn't specify any variables. So let me go ahead and run that one more
time and put the URL
for net.com and click on OK. All right, so this is started the playbook. So I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for net.com and click on OK. All right, so this is started the playbook. So I
've got the data and
attached it to the incident. Hooray. So again, the key here with playbooks, let
me refresh this,
is that once we have playbooks that we're going to use all the time, it makes
it very,
very easy to be consistent and get the information we need with just a couple
clicks of the button.
Or if they're automated based on events or incidents, they can automatically
run based on those
situations occurring.