---
title: "Dry run threats for playbooks"
slug: "dry-run-threats-for-playbooks"
updated: 2026-09-09T16:09:29Z
published: 2026-09-09T16:09:29Z
canonical: "docs.redcanary.com/dry-run-threats-for-playbooks"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Dry Run Threats for Playbooks

This article leads through the process of checking whether a threat matches the conditions you have set for a trigger since playbooks are only run when all trigger conditions match. A threat can change over time and this tool allows you to see what the state of the threat is at the time automation is run. Threats published in the last 90 days are available for trigger dry runs.

The steps below take into account that you already know how to access and run playbooks.

## Check if the trigger’s conditions match a threat

1. In the Zscaler MDR portal, click **Automation**.
2. Review your listed playbooks.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/meet cond.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A58%3A31Z&se=2026-11-01T17%3A58%3A31Z&sr=c&sp=r&sig=%2Br%2FF0%2BxXPrb8fmC20UhizrQaA0NW75INpmecWh7jSaM%3D)
3. If a playbook does not run, click **Check if a Threat meets these conditions**.

> [!NOTE]
> Note: A checkmark indicates if the trigger’s condition matches a threat.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/match.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A58%3A31Z&se=2026-11-01T17%3A58%3A31Z&sr=c&sp=r&sig=%2Br%2FF0%2BxXPrb8fmC20UhizrQaA0NW75INpmecWh7jSaM%3D)

## Trigger condition does not match a threat

Under most conditions, you will be able to see exactly why a condition failed to match. In this example a threat was remediated, but since its severity was Low, the trigger did not match and the playbook(s) did not run.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/dont match.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A58%3A31Z&se=2026-11-01T17%3A58%3A31Z&sr=c&sp=r&sig=%2Br%2FF0%2BxXPrb8fmC20UhizrQaA0NW75INpmecWh7jSaM%3D)

The threat was originally listed as low severity but was later increased to high, which is why the condition did not match.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/upgrade.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A58%3A31Z&se=2026-11-01T17%3A58%3A31Z&sr=c&sp=r&sig=%2Br%2FF0%2BxXPrb8fmC20UhizrQaA0NW75INpmecWh7jSaM%3D)

## Updates to threats

When there is a [substantive update](/doc/docs/threats) to a threat, Zscaler MDR will re-publish the threat.

1. To see whether a threat has been updated, click the dropdown arrow from the **Check** field.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/update.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A58%3A31Z&se=2026-11-01T17%3A58%3A31Z&sr=c&sp=r&sig=%2Br%2FF0%2BxXPrb8fmC20UhizrQaA0NW75INpmecWh7jSaM%3D)

> [!NOTE]
> Note: Multiple options display, each with a timestamp of the published time.
2. Select the correct threat to run the playbook.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/check.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A58%3A31Z&se=2026-11-01T17%3A58%3A31Z&sr=c&sp=r&sig=%2Br%2FF0%2BxXPrb8fmC20UhizrQaA0NW75INpmecWh7jSaM%3D)

## Classification differences

This is an example of a recently remediated threat that includes **Credential Theft** as the threat secondary classification.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/second.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A58%3A31Z&se=2026-11-01T17%3A58%3A31Z&sr=c&sp=r&sig=%2Br%2FF0%2BxXPrb8fmC20UhizrQaA0NW75INpmecWh7jSaM%3D)

This is an example of a trigger condition that has changed because the secondary classification updated after the threat was remediated.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/not rem.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A58%3A31Z&se=2026-11-01T17%3A58%3A31Z&sr=c&sp=r&sig=%2Br%2FF0%2BxXPrb8fmC20UhizrQaA0NW75INpmecWh7jSaM%3D)

1. To match the conditions, click the dropdown arrow from the **Check** field.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/update.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A58%3A31Z&se=2026-11-01T17%3A58%3A31Z&sr=c&sp=r&sig=%2Br%2FF0%2BxXPrb8fmC20UhizrQaA0NW75INpmecWh7jSaM%3D)
2. Select the desired Threat value.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/value.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A58%3A31Z&se=2026-11-01T17%3A58%3A31Z&sr=c&sp=r&sig=%2Br%2FF0%2BxXPrb8fmC20UhizrQaA0NW75INpmecWh7jSaM%3D)

> [!NOTE]
> Note: Threats may have more than one version if there has been a [Substantive Update](/doc/docs/threats?highlight=substantive%20update). The timestamp provided refers to the latest publish time.