last updated: mar 21, 2025
On Event Ingestion
Executes tasks either during playbook test run or when the playbook is activated as part of data ingestion through a schedule or webhook.
Playbook Test Run
-
Click on the Test Playbook button.
-
Select an ingested event, then click on the Run Test button.
-
Verify that tasks execute.
Schedule-Induced Execution (CrowdStrike)
Webhook-Induced Execution (CrowdStrike)
-
Build a simple playbook that sends an email upon being activated.
-
Submit this playbook.
-
Set up a webhook key.
-
Copy the POST request URL into Postman, then input the following raw JSON data:
JSON{ "resources": { "description": "Created from a webhook push" } }
READER NOTE *
-
The raw JSON data must include at least the main JSON path (i.e., $.resources for CrowdStrike) to generate a D3 event, which will be used to run the preprocessing playbook.
-
Subsequent POST requests with identical payloads will not generate additional D3 events.
-
Copy the POST request header key and head value into Postman.
-
Select the submitted playbook under Additional Settings.
-
Send the POST request.
-
Check the email to verify that the playbook was triggered.
After Event Dismissal
Executes tasks after an event is dismissed.
Ingestion-Dismissal Example (Webhook)
-
Build a simple playbook that sends an email upon being activated.
-
Add a Dismiss task to the On Event Ingestion trigger.
-
Submit this playbook.
-
Set up a webhook key.
-
Copy the POST request URL into Postman, then input the following raw JSON data:
JSON{ "resources": { "description": "This event will be dismissed." } }
READER NOTE *
-
The raw JSON data must include at least the main JSON path (i.e., $.resources for CrowdStrike) to generate a D3 event, which will be used to run the preprocessing playbook.
-
Subsequent POST requests with identical payloads will not generate additional D3 events.
-
Copy the POST request header key and head value into Postman.
-
Select the submitted playbook under Additional Settings.
-
Send the POST request.
-
Check the email to verify that the playbook was triggered.
On Playbook Task Error
Executes tasks when a playbook task encounters an error.
Example 1 - Error in Current-Level Playbook Task
-
Set up an error-resulting task on the On Event Ingestion trigger, ensuring that the Error Trigger handling option is checked.
-
Set up a Send Email utility command task for the On Playbook Task Error trigger.
-
Test run this playbook (see On Event Ingestion examples), ensuring that the Error Task results in
, and the Send Email task results in
.
-
Check the email for the error message.
Example 2 - Error Emitted from Nested Playbook
-
Create a Codeless Playbook utility command.
-
Setup a task that would result in an error. Click on the
button to verify.
-
Enable its use as a command task.
-
Use a
passdown task to emit an error message to the parent playbook.
-
Submit this utility command.
-
Create an investigation playbook.
-
Set up the Demo Nested Playbook Utility Command task on the On Event Ingestion trigger, ensuring the Error Trigger checkbox is ticked.
-
Set up a Send Email utility command task for the On Playbook Task Error trigger.
-
Test run this playbook (see On Event Ingestion examples), ensuring that the Demo Nested Playbook Utility Command task results in
, and the Send Email task results in
.
-
Check the email for the error message.