FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
Andy_G
Staff
Staff
Article Id 198519
Description

Challenge:

Do you see any of your playbooks is running in an endless loop?

Yes!

 

 

This can happen when the playbook is created as follows:

1) Playbook trigger is set as either 'Post Update' or 'Post Create' trigger and

2) Playbook contains a step to either update the current record or to create a new record.

In such cases, the playbook history will be filled with multiple instances of your playbook execution.

 

Solution:

One way to stop the running instance of the playbook is to mark the playbook as 'Inactive'.

 

You will observe that playbooks are still running even after they are marked as Inactive, this is because the playbooks that are in the playbook queue will yet be running, however, this stops the process of creating another instance of running playbook in the queue. Therefore, once all playbook instances from queue complete their execution, the playbook falls out of the endless loop and you will observe that playbook instances are not getting executed in the 'Running Playbook History'.

 

Note: When you are creating playbooks with 'Post Update' or 'Post Create' trigger, specify the trigger condition(s) very carefully.



Contributors