Launching playbooks in the Training operation mode

The Training operation mode allows you to check if the playbook is configured correctly. This can be helpful if you are planning to change the playbook operation mode to Auto.

All playbooks in the Training operation mode request the user's approval to launch.

To launch a playbook in the Training operation mode, you must have one of the following roles: Main administrator, Tier 1 analyst, Tier 2 analyst, Tenant administrator.

In the Training operation mode, the playbook is triggered by alerts or incidents, but requires manual approval before launch. You can test launching the playbook in the Training operation mode in one of the following ways:

• Create an alert or incident that matches the playbook trigger.
• Edit an alert or incident that matches the playbook trigger. The alert or incident must be in a status other than Closed.

  Editing an alert or incident triggers the playbook only if the trigger is set to respond to manual changes. By default, manual changes to an alert or incident are ignored. To make the playbook respond to manual changes, the trigger must use the event.manual function. For details, refer to Playbook trigger.

When one of the above actions is completed, the playbook requests the user's approval to launch. For more information on how to approve the playbook, see Approving playbooks or response actions.

The manual approval for launching the playbook is limited to 60 minutes.

Page top