Has anyone utilized the Re-Attach Playbook under Tools before and can explain how it works?

hi, can you elaborate on this? there is an option to add manually playbook to run on alert, are you referring to this or something else?

Hi Dmitry, not that action, under the Power-ups tab, we have the Tools actions and that contains the Re-Attach Playbook action

i see, thanks for the info, im not familiar with it, will try to check as well

Alright, please get back to me if you have any update. Thanks

wow i missed this one im sorry, checking it now
i can see that the action goes to the DB and try to remove any "links" between alert and playbook, and attach playbook again

let me also ask internally about this action

hey, to follow up on this, i got info that that action only supports on prem instances of Chronicle SOAR. It's not for SaaS.
in its current form its going to be deprecated.
The alternative could be the option to rerun playbook available on the playbook screen in Chronicle UI

Alright @Dmitry_Sarakeev , thanks

Hi @Dmitry_Sarakeev , just thinking of it now, since the option to rerun a playbook is available through the UI, why cant we have this as an action that can be called from within the playbook itself provided certain conditions are met

afaik the team plans to do something with the action, but as similar is available in ui, the change took less priority

Alright, just that there are some use-cases we have that the action will be useful for.