Skip to main content
Solved

SOAR playbook to fetch logged in user

  • February 27, 2026
  • 2 replies
  • 19 views

w8lessly
Forum|alt.badge.img

TL;DR Can a playbook runtime get the secops user logged in?


We’ve got a SecOps Playbook that processes SNOW requests. At the end we either auto-decide - using SNOW API and a service account, or a manual decision has to happen (approve/reject). Now, we want this manual step to happen in Google SecOps rather than SNOW. I can create a multi-choice step for the agents to provide with their decision, but then we need to ensure the SNOW request is being modified (approved) on behalf of their SNOW account. This would be very easy for me to do if somehow the playbook could get the logged in (into Google SecOps) user id/email who performs this manual action. Because then I can pull the SYS_APPROVER_ID from SNOW via API.

Best answer by hzmndt

@w8lessly 

Try use placeholder like below: 

 

[General.CurrentUserEmail]
[General.CurrentUserFullName]

 


 

2 replies

hzmndt
Staff
Forum|alt.badge.img+10
  • Staff
  • Answer
  • February 27, 2026

@w8lessly 

Try use placeholder like below: 

 

[General.CurrentUserEmail]
[General.CurrentUserFullName]

 


 


w8lessly
Forum|alt.badge.img
  • Author
  • New Member
  • February 27, 2026

@hzmndt Oh, you are right. Tried this, but in automatic steps it simply returns the name of the placeholder. Manual actions have it though. Much appreciated!