Playbook prioritization

Hi @Akshay04, 

IIRC only a single playbook can be attached to an alert automatically. You likely have a higher priority for the SLA playbook as you mentioned that you configured it to attach to all alerts - this is the only one that will ever be attached. As a workaround, you can have a conditional within your SLA playbook and programatically attach additional playbooks to the case as per your requirements using the SOAR action. 

Alternatively, you can have the SLA component configured as a Block and attach the blocks to the relevant playbooks - this is what we've done internally. 

Can you share me your SLA Play book flow? i had added "Delay playbook" as a step which is not at all reliable for added it as a block in other playbooks.

Playbook Flow

1. Trigger Node (Yellow - All Cases)

   • Purpose: This node initiates the playbook for all incoming cases.(Except the alerts wich already have playbooks).

   • Trigger: Automatically runs when a new case is opened.

2. Step 1: Tools_Get Case SLA

   • Function: Retrieves SLA and critical SLA values associated with the case.

   • Output: Provides SLA timestamps in multiple formats.

3. Step 2: Tools_Get Current DateTime

   • Function: Captures the current system time when the playbook is triggered.

4. Step 3: Functions_Time Difference

   • Function: Calculates the time difference between the current time and the SLA deadline.

   • Use Case: Determines how much time is left before SLA breach.

5. Step 4: Tools_Delay Playbook

   • Function: Delays the next steps in the playbook execution until the SLA threshold (e.g., 10 minutes before breach).

   • Purpose: Prevents early alerting; ensures timely action.

6. Step 5: Slack_Send Advanced Message

   • Function: Sends an advanced formatted message to a predefined Slack channel.

You could do something like:

1. Create a block for SLA retrieval - Steps 1-3
2. Move Steps 4-5 into the individual playbooks (Moves delay out of the blocks)

In the SLA that we use, we have a similar flow but also have steps for setting longer SLAs based on the day of the week and assigning it to specific teams. We also have the Delay component at the end of the playbook with send message to ensure that we don't disrupt the rest of the playbook's functionality.