Setting conditions that activate a playbook

Use the Condition builder to create conditions that activate the playbook. For example, you can set activation conditions based on whether an incident was created or based on the value of a specific field.

The Activation type determines how a playbook is activated.

Automatic activates the playbook when the specified conditions are met. A playbook must have at least one condition to be activated automatically.
Manual uses conditions to determine when the playbook appears in an incident's Action menu. From there, a user can choose whether to activate the playbook. If no conditions are specified, a manual playbook always appears in the object's Action menu.

The playbook's Object type determines which conditions are available. With specific object types, you can select fields from the parent object. For example, you can select incident fields for a playbook that has a Task or Note object type. However, activation logic and conditions are evaluated only when changes are made to the playbook's object. For example, activation for a task-based playbook is evaluated only when a task is updated. It is not evaluated when its parent incident is updated.

Procedure

On the SOAR Platform home page, click Playbooks and find the playbook that you want to configure.
Click the playbook name to open it on the canvas editor.
Select the activation node to open the Activation details window.
Tip: The activation node is the first node in the playbook.
Expand the Automatic activation section and open the Condition builder window.
- If there are no conditions, click Create condition.
- To edit existing conditions, click the edit icon.
Specify the activation conditions that you want to set.
To specify more than one condition, click Add condition.
Choose from the following options when you build the condition set.
- All activates the playbook only when all of the conditions match.
- Any activates the playbook when one or more conditions match.
- Advanced provides the option to build different types of condition sets.
For more information about building conditions, see Conditions in playbooks.
Click Done and then click Save.

For example, the following image shows three conditions where all conditions must be true to activate the incident. An incident type must be malware, the city must be Berlin, and the country must be Germany.