Playbook Triggers
LAST UPDATED: JAN 15, 2025
A trigger is a condition that initiates the execution of workflows within a preprocessing playbook or investigation playbook. It defines the starting point of an automated workflow. Users can customize the visibility of the three preprocessing playbook triggers and eight investigation playbook triggers through the blue root playbook node.
%201-20250115-194955.png?inst-v=05328674-b079-4c01-ba41-8dd92707b455)
%201-20250115-195000.png?inst-v=05328674-b079-4c01-ba41-8dd92707b455)
Managing Triggers
Adding a trigger to an investigation or preprocessing playbook follows the same process, as outlined below:
Click on the + Add Trigger button.
Select a trigger.
Click on the Add Trigger button.
Triggers can be deleted from preprocessing and investigation playbooks using the Delete Trigger button displayed after selecting a trigger:
Select a trigger to delete.
Click on the Delete Trigger button.
READER NOTE
Trigger branches can be removed unless connected to task nodes, in which case can be handled in one of two ways:
Remove the trigger connector
-20250115-201018.png?inst-v=05328674-b079-4c01-ba41-8dd92707b455)
Delete all dependent nodes sequentially, starting from the leaf to the root.
-20250115-202619.png?inst-v=05328674-b079-4c01-ba41-8dd92707b455)