Can Alert Playbooks be triggered by Case Stage changes (Investigation / Research)?

Today, a Playbook cannot be triggered by a case stage change. Reaction Triggers are coming to preview soon and will enable trigger via a case stage change as well as other options - https://docs.cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/using-reaction-triggers-in-playbooks.

Is there any way to do this using the resources currently available in SECOPs?

Is the stage being changed manually today? The closest you could get pending the release of the reaction triggers would be to create a Playbook that changes the stage and then have your HTTPv2 action in the playbook as well. From there, create a quick action (https://docs.cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/what-actions-can-you-take-on-a-case#quick-actions) that executes the playbook and then update your view with the quick actions widget.

That would provide you a widget on the alert or case page that would look like this:

When that button is clicked the playbook is executed and the case stage is changed followed by your HTTPv2 action.

Hi ​@iLotuus,

Besides waiting for the Reaction Trigger feature to be avaliable, the other way would be to create a job that runs every X minutes, that lists all cases, identifies those newly moved to those two mentioned 'Investigation' or 'Research', and then attach a block to that case which does the HTTP v2 action etc.

Write jobs  |  Google Security Operations  |  Google Cloud Documentation

Kind Regards,

Ayman

There is option to build job that will check every X minutes/hours for all cases that got X or Y
 

example here

For most of our workflows, we use playbook logic that either awaits analyst feedback and then attaches the next blocks or triggers child playbooks accordingly.

For non-automated actions, we use buttons that analysts can manually trigger to attach the necessary content.