Partially Executable Playbooks

[sidPhoenix17]

As a design choice, we built workflows to give the user a choice to either execute the playbooks in its entirety or not execute it and just get a context-filled playbook execution page with a start button. After a while, we came to a realisation that the hesitation to not execute automatically came from the fact that users don’t really trust platforms to auto execute remediation actions. However, they were looking to get their queries completed in background and getting a summary.

So, we decided to allow them to do both. Flag certain tasks in their playbooks which should never be executed on their own, even if the workflow is configured to execute the playbook in the background. When the execution engine reaches such a task, it will halt and share the so far executed playbook summary only to the user. This way, they can run their queries automatically and take action manually from the summary page.