Views:

View the details of an action node in a playbook execution and approve or reject actions.

In the Actions section of the Execution details screen, clicking Check details in a listed node opens the Action Details screen, which tallies and lists the status of the action for each target of the selected node.
There are six possible action statuses:
  • Pending approval (pending_approval=7ad48a47-cb38-4fff-9dee-cceb77d9c5c1.png): Action requires approval to execute on the specified target
    Note
    Note
    Pending actions expire if not approved within 24 hours of executing a playbook.
  • In progress... (in_progress=51020eba-8ed4-4fca-9bdd-73158770bb4d.png): Action executing on the specified target
  • Successful (successful=9cb8192f-f627-4fa2-b6dc-f77c09ac5d18.png): Action executed successfully
  • Unsuccessful (unsuccessful=78851f4e-24ea-4fde-bbe4-370e3d55f811.png): An error occurred executing the action on the specified target
  • Expired (expired=83F80B9E-6F02-4C2B-8E6C-6A69E8C78A93.png): Approval not given to execute the action on the specified target
  • No action taken (no_action_taken=AD5719B0-ABF6-4759-8A6B-510DFAF4B908.png): Action not executed because the specified endpoint is outside the asset visibility scope of the user who started the playbook execution
The following table outlines the actions available in the Action Details screen.
Action
Description
Filter actions
Use the Search field and the Status drop-down list to locate specific actions
Note
Note
The Search field is only displayed if there are searchable targets.
Approve or reject all pending actions
Click Approve/RejectApprove All Pending or Approve/RejectReject All Pending
Important
Important
For customers that have updated to the Foundation Services release, the ability to approve or reject actions for certain endpoints depends on the asset visibility scope of the current user.
Note
Note
Approve/Reject is only displayed if there are actions that require approval for execution.
Approve or reject some pending actions
Select Pending approval actions and click Approve Selected or Reject Selected
View all response actions taken on the target
Click the options button (options_btn=068b1512-4150-419b-9cba-6569fc5fd92c.png) associated with the target and click View All Actions on the Target.
You will be taken to the Response Management app, with the response tasks filtered by the target.
Note
Note
This feature is available only when the action initiated from Security Playbooks is In progress..., Successful, or Unsuccessful and the target is within your asset visibility scope.