Hello,
I have a question about the "Quick Action" Feature.
I understand that you can use quick action buttons linked to integration actions. But is there a way to link it to a playbook block?
I tried using the "Attach playbook to alert" But this workaround does not allow for custom input for the playbook.
Is this something that is on the road map for the "Quick Actions"?
https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/quick-actions?hl=en
Solved
Quick Actions & Playbook Blocks
+6- Bronze 5
Best answer by ylandovskyy
What about the input for the block, where would i provide them? Or during the quick action execution will it open another modal for the block inputs?
Hey @mokatsu ,
If you need to provide an input, then you would need to wrap a block inside playbook and then set the block to be a manual step. That way before block execution, you will be asked to manually provide the inputs.
Here are some screenshots:
+16Hey @mokatsu ,
In Tools powerup, we also have an action called "Add Playbook To Alert". It works differently from the one in Siemplify integration. It allows you to provide a custom name via String parameter. I've tested it and it works for blocks as well.
+6- Bronze 5
Hey @mokatsu ,
In Tools powerup, we also have an action called "Add Playbook To Alert". It works differently from the one in Siemplify integration. It allows you to provide a custom name via String parameter. I've tested it and it works for blocks as well.
What about the input for the block, where would i provide them? Or during the quick action execution will it open another modal for the block inputs?
+16What about the input for the block, where would i provide them? Or during the quick action execution will it open another modal for the block inputs?
Hey @mokatsu ,
If you need to provide an input, then you would need to wrap a block inside playbook and then set the block to be a manual step. That way before block execution, you will be asked to manually provide the inputs.
Here are some screenshots:
+6- Bronze 5
Hey @mokatsu ,
If you need to provide an input, then you would need to wrap a block inside playbook and then set the block to be a manual step. That way before block execution, you will be asked to manually provide the inputs.
Here are some screenshots:
I do want to say, I am accepting this solutions as a work around not a solution. I do believe the quick actions should be extended to also user playbook blocks at the least.
Hey guys.
If you need to call a block instead of a playbook inside the quick action widget, it is possible.
I was having the same issue; my request was to attach blocks instead of the playbook using the quick action. I was frustrated and disappointed as I tried different configurations, scenarios, and more, but they didn't work. However, by mistake, I noticed that using the action “Attach Playbook to All Case Alerts” using this automation as an action allows me to attach blocks to alerts instead of the playbook.
+7- Silver 1
Hey @mokatsu ,
If you need to provide an input, then you would need to wrap a block inside playbook and then set the block to be a manual step. That way before block execution, you will be asked to manually provide the inputs.
Here are some screenshots:
I do want to say, I am accepting this solutions as a work around not a solution. I do believe the quick actions should be extended to also user playbook blocks at the least.
I agree, this is a work around. our analysts need to press the quick action button > Execute > add inputs and then execute again.. Definitely not a solution..
Login to the community
Login with SSO
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.