Preprocessing Playbook Triggers | User Docs

Executes tasks either during playbook test run or when the playbook is activated as part of data ingestion through a schedule or webhook.

Playbook Test Run

Select Test Playbook in the toolbar.
In the Run Test window, on the Test Event Ingestion tab, choose the Site and an ingested Event, then select Run Test.
Verify that tasks execute.

Schedule-Induced Execution (CrowdStrike)

Tip: you can also generate this playbook with AI. See Generating with AI.

Build a simple playbook that sends an email upon being activated.
Select Go Live to make this playbook live.
Setup a schedule using the live playbook.
Wait for data to flow in, then stop the schedule (Stop on its schedule card) after some events have been automatically created.
Check the email to verify that the playbook was triggered.

Webhook-Induced Execution (CrowdStrike)

Copy the Request URL (POST) into Postman, then input the following raw JSON data:

JSON

{
    "resources": {
        "description": "Created from a webhook push"
    }
}

READER NOTE *

The raw JSON data must include at least the main JSON path (i.e., $.resources for CrowdStrike) to generate a D3 event, which will be used to run the preprocessing playbook.
Subsequent POST requests with identical payloads will not generate additional D3 events.

Copy the Request Header Key and Request Header Value into Postman.
Under Additional Settings, select the live playbook as the PREPROCESSING PLAYBOOK.
Send the POST request.
Check the email to verify that the playbook was triggered.

Executes tasks after an event is dismissed.

Ingestion-Dismissal Example (Webhook)

Copy the Request URL (POST) into Postman, then input the following raw JSON data:

JSON

{
    "resources": {
        "description": "This event will be dismissed."
    }
}

READER NOTE *

The raw JSON data must include at least the main JSON path (i.e., $.resources for CrowdStrike) to generate a D3 event, which will be used to run the preprocessing playbook.
Subsequent POST requests with identical payloads will not generate additional D3 events.

Copy the Request Header Key and Request Header Value into Postman.
Under Additional Settings, select the live playbook as the PREPROCESSING PLAYBOOK.
Send the POST request.
Check the email to verify that the playbook was triggered.

Executes tasks when a playbook task encounters an error.

Example 1 - Error in Current-Level Playbook Task

Example 2 - Error Emitted from Nested Playbook

Create a Codeless Playbook utility command.
Setup a task that would result in an error. Click on the button to verify.
On the command's Settings sub-tab, under FEATURES, switch on Command Task.
Use a image 6 (5)-20250110-020837.png passdown task to emit an error message to the parent playbook.
Submit this utility command.
Create an investigation playbook.
Set up the Demo Nested Playbook Utility Command task on the On Event Ingestion trigger, ensuring the Error Trigger checkbox is ticked.
Set up a Send Email utility command task for the On Playbook Task Error trigger.
Test run this playbook (see On Event Ingestion examples), ensuring that the Demo Nested Playbook Utility Command task results in lab190.d3securityonline.net_16_8_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=0136de1ab403e957e8f2e3830f55e0d07561dc2f2fc5b0d4be07936dd48d9993 (5) 2-20250110-022826.png, and the Send Email task results in lab190.d3securityonline.net_16_8_VSOC_LifeServer.aspx_div=dashboard&Open=Other&t2=0136de1ab403e957e8f2e3830f55e0d07561dc2f2fc5b0d4be07936dd48d9993 (5) 3-20250110-022810.png.
Check the email for the error message.

On Event Ingestion