Customize when a Playbook is Run with Triggers

1. Click Configure new Trigger and select the event you want to start with.

2. Adjust the trigger’s name to describe your use case. Customize the conditions to meet your use case. Keep in mind that certain fields will only be available for certain events. 

3. Click Save.

Triggers are active by default. Click the Active slider to deactivate the trigger and prevent it from firing, or click the   icon to permanently delete the trigger.

Note: Red Canary observes Daylight Saving Time (DST) except in Coordinated Universal Time (UTC)

Each trigger condition has a matcher that determines how values are matched. Please ensure there is no whitespace in the tags. For fields that contain one of a known set of values, one of the following matchers might be available:

For fields that contain a list of known sets of values, one of the following matchers should be available:

For fields that contain a list of values, one of the following matchers should be available:

For fields with text values, one of the following matchers should be available:

For numeric fields, one of the following matchers should be available:

When selecting When an Intelligence Profile is added to a Threat, it will match the following conditions: 

• Threat

• Intelligence profile

• Endpoint

• Identity

• Time

• Subdomain

Any associated triggers will fire and execute the connected playbook. The executed playbook is aware of the updated threat as well as the added intelligence profile.

Note: Be aware that triggers will continually be evaluated and fire for 60 days after the initial triggering condition then cease to fire. This will primarily impact playbooks designed to auto decommission endpoints after a set period of time. Please resolve these triggering actions at 59 days to avoid this limitation.

1. Click Connect Playbook next to any trigger.

2. Click Create a new Playbook.

   Note: This may take some time. A loading automation triggers & playbooks message displays.

3. Click the new playbook to begin editing.

4. Enter a name and description for the playbook (these changes will save automatically).

Playbooks are active by default. Click the Active slider to deactivate the playbook and prevent it from executing, or click the   icon to permanently delete the playbook.

Automation playbooks are designed to be executed by triggers or manual execution. There are many use cases for manual execution, including testing a new playbook to ensure it works as expected and executing certain remediation playbooks that should only be triggered by your team.

Playbooks can be executed against any of the threats, endpoints, and endpoint users in Red Canary. You can manually execute a playbook by selecting an object that you’d like to execute against.

1. When viewing any playbook, click Run.

2. Select an object type to execute against.

3. Select an object of that type.

4. Click Run.

The playbook will begin executing. Click Follow along with the progress here in the resulting dialog to see the results.