WEBVTT 1 00:00.000 --> 00:05.730 In order for 40 analyzer to interact with other devices and execute playbooks, 2 00:05.730 --> 00:06.240 using those other 3 00:06.240 --> 00:10.590 devices, it's going to use a set of connectors. And as I mentioned in the 4 00:10.590 --> 00:11.840 overview, depending on 5 00:11.840 --> 00:15.680 what connectors we have set up is going to control what 40 analyzer is able to 6 00:15.680 --> 00:16.800 interact with. So to 7 00:16.800 --> 00:21.000 get a better idea of connectors that are in place and or available on the 40 8 00:21.000 --> 00:21.920 analyzer, let's make 9 00:21.920 --> 00:25.630 a road trip over to our 40 analyzer. All right, and here we go. Let me go ahead 10 00:25.630 --> 00:26.480 and log in. I'll 11 00:26.480 --> 00:30.300 supply the password, click log in. And because we are using administrative WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:26.480 --> 00:30.300 supply the password, click log in. And because we are using administrative 12 00:30.300 --> 00:31.280 domains, it's going to 13 00:31.280 --> 00:34.500 ask us about which ADAM we want to go into. We're going to go into the root AD 14 00:34.500 --> 00:35.440 AM where I have four 15 00:35.440 --> 00:42.140 devices. And again, this is the firmware version 763F as in, hope it works 16 00:42.140 --> 00:43.760 because the feature version 17 00:43.760 --> 00:47.260 is not one you should use in production. You should make sure you use the 18 00:47.260 --> 00:48.480 mature versions, 19 00:48.480 --> 00:52.360 but for the demos and for the set of videos, I have chosen the feature version. 20 00:52.360 --> 00:52.800 Because going 21 00:52.800 --> 00:56.880 forward, what's going to happen is the interface here is going to be adopted as 22 00:56.880 --> 00:57.600 versions become 23 00:57.600 --> 01:01.740 more mature. So as far as the connectors go and automation in general on the 40 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 23 00:57.600 --> 01:01.740 more mature. So as far as the connectors go and automation in general on the 40 24 01:01.740 --> 01:02.400 analyzer, 25 01:02.400 --> 01:07.280 we're going to go down to incidents and events. And under incidents and events, 26 01:07.280 --> 01:10.720 we have an option right here called automation. And those were going to see all 27 01:10.720 --> 01:11.360 the details 28 01:11.360 --> 01:15.030 regarding playbooks and automation with playbooks. So we'll click here on 29 01:15.030 --> 01:16.160 automation. And we are 30 01:16.160 --> 01:20.220 on the summary tab. I was doing some play earlier today with various testing of 31 01:20.220 --> 01:21.280 some playbooks. 32 01:21.280 --> 01:24.890 But what I want to do right now in this video is take a look at active 33 01:24.890 --> 01:26.400 connectors. So currently, 34 01:26.400 --> 01:30.950 I have some connections to some 48 firewalls. And this is just updating the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 34 01:26.400 --> 01:30.950 I have some connections to some 48 firewalls. And this is just updating the 35 01:30.950 --> 01:31.840 health stuff there. 36 01:31.840 --> 01:35.190 So this says three devices connected, three devices disconnected. I do have 37 01:35.190 --> 01:35.920 four firewalls 38 01:35.920 --> 01:39.350 in HA pairs. So we click here, it's going to show us. So I've got the branch 39 01:39.350 --> 01:40.480 firewall one and it's 40 01:40.480 --> 01:45.180 HA pair. And I've got the 48 fabric, the headquarters site with firewalls one, 41 01:45.180 --> 01:46.800 two, and three firewall, 42 01:46.800 --> 01:51.920 one is the route. And then over here, I've got 48 fabric again. And there's no 43 01:51.920 --> 01:52.320 automation 44 01:52.320 --> 01:56.110 rules configured on this device. We'll take a look in another video about local 45 01:56.110 --> 01:56.720 configured 46 01:56.720 --> 02:01.430 automation rules. But for now, I just want to confirm that we have access with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 46 01:56.720 --> 02:01.430 automation rules. But for now, I just want to confirm that we have access with 47 02:01.430 --> 02:02.000 this 40 48 02:02.000 --> 02:06.420 OS connector from the 40 analyzer over to our 48 firewalls. Let me go ahead and 49 02:06.420 --> 02:07.040 close that. 50 02:07.040 --> 02:11.220 Here's the local connector. Effectively, that's the connector of the 40 analy 51 02:11.220 --> 02:12.720 zer to itself. And 52 02:12.720 --> 02:15.930 then we have the 40 guard connector. And then all these others, I don't have 53 02:15.930 --> 02:16.640 those components in 54 02:16.640 --> 02:20.720 place. So they're showing up as grayed out. Now, if we wanted to add another 55 02:20.720 --> 02:21.760 connector, what we 56 02:21.760 --> 02:25.670 could do is click on create new and here are 20 security fabric connectors that 57 02:25.670 --> 02:26.560 we could add. 58 02:26.560 --> 02:30.870 And we also have some IT service management connectors with service now, slack, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 58 02:26.560 --> 02:30.870 And we also have some IT service management connectors with service now, slack, 59 02:30.870 --> 02:31.440 MS teams, 60 02:31.440 --> 02:34.660 and a generic connector as well. And if we could cancel here and scroll down a 61 02:34.660 --> 02:35.360 little bit on the 62 02:35.360 --> 02:39.810 active connections page here, there's also a third party connector for virus 63 02:39.810 --> 02:40.720 total right here. 64 02:40.720 --> 02:45.060 Now, currently it is not enabled. Also, it is not yet configured. So if we 65 02:45.060 --> 02:45.760 double click on virus 66 02:45.760 --> 02:50.620 total, what we could do is go ahead and put in the API key that would authorize 67 02:50.620 --> 02:51.680 us effectively 68 02:51.680 --> 02:55.920 to go ahead and make queries up to virus total. So I made a free account up at 69 02:55.920 --> 02:56.640 virus total. That's 70 02:56.640 --> 03:01.120 right now on this page. And if you go to Keith Barker there and go to API key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 70 02:56.640 --> 03:01.120 right now on this page. And if you go to Keith Barker there and go to API key. 71 03:01.120 --> 03:01.920 So here's the API 72 03:01.920 --> 03:04.870 key that we can insert there. We can click on here to copy, put on a seat, 73 03:04.870 --> 03:05.760 click on the eyeball. 74 03:05.760 --> 03:09.920 And there's also quotas with my free account. So if you want to upgrade and 75 03:09.920 --> 03:11.200 have more ability and 76 03:11.200 --> 03:15.280 more quantity for API calls, you can go ahead and do an upgrade. But for the 77 03:15.280 --> 03:16.080 free version, 78 03:16.080 --> 03:21.570 you get four lookups per minute and 500 lookups per day. And the monthly quota 79 03:21.570 --> 03:22.560 is 15 and a half 80 03:22.560 --> 03:25.950 thousand lookups per month. It's also saying that for this free version, you're 81 03:25.950 --> 03:26.560 not supposed to use 82 03:26.560 --> 03:29.900 it in business workflows, commercial products, or services. So effectively, if 83 03:29.900 --> 03:30.400 you're going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 83 03:29.900 --> 03:30.400 you're going to 84 03:30.400 --> 03:33.360 use this for your production business, you'd want to upgrade and not use the 85 03:33.360 --> 03:34.080 free account. 86 03:34.080 --> 03:39.040 So I'm going to go ahead and click here, copy to copy my API key. And then with 87 03:39.040 --> 03:40.080 that now my clipboard, 88 03:40.080 --> 03:44.320 I'll go over here to the configuration for the virus total connector. And for 89 03:44.320 --> 03:45.360 the API key, I'll 90 03:45.360 --> 03:49.300 delete that and I'll do a control V and I'll paste in that key. And then here 91 03:49.300 --> 03:50.560 on the action tab, 92 03:50.560 --> 03:53.560 it's supposed to find what we're able to do with virus total. So we can query 93 03:53.560 --> 03:55.200 based on IP or domain 94 03:55.200 --> 03:59.930 or URL to get more information on a specific IP domain or URL. So go back to 95 03:59.930 --> 04:01.360 configuration we go, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 95 03:59.930 --> 04:01.360 configuration we go, 96 04:01.360 --> 04:05.320 we'll click on OK. And now that it's configured, I also want to go ahead and 97 04:05.320 --> 04:06.400 enable it. So if we 98 04:06.400 --> 04:10.290 click right here on enable, here's a little green check, which is great. API 99 04:10.290 --> 04:11.440 connection is 100 04:11.440 --> 04:14.670 successful, which is a good indicator. And as another example, we scroll up 101 04:14.670 --> 04:15.440 here for four guard 102 04:15.440 --> 04:17.970 connector, let me go ahead and refresh that real quick. And now we have a green 103 04:17.970 --> 04:18.400 check there, 104 04:18.400 --> 04:21.680 which is great. So we're curious about whether or not we have our connectors in 105 04:21.680 --> 04:22.480 place. Here's 106 04:22.480 --> 04:26.700 where we go under instant events, automation, and active connectors. And then 107 04:26.700 --> 04:27.600 also confirm that we 108 04:27.600 --> 04:30.310 have the connections in place that we want to use. And as an example of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 108 04:27.600 --> 04:30.310 have the connections in place that we want to use. And as an example of 109 04:30.310 --> 04:31.040 creating a new one, 110 04:31.040 --> 04:36.560 let's go to create new. And let's see when I can demo here, how about there's 111 04:36.560 --> 04:38.000 Cisco ice, 112 04:38.000 --> 04:42.690 vSphere, I can do that. I've got some vSphere servers in my environment. So I 113 04:42.690 --> 04:43.680 go ahead and 114 04:43.680 --> 04:47.320 let me select vSphere by double clicking on it. And in my lab environment, it's 115 04:47.320 --> 04:50.000 at 192.168.111. 116 04:50.000 --> 04:54.320 That's the vCenter server component. And the username, let me look for that up 117 04:54.320 --> 04:54.640 real quick, 118 04:54.640 --> 05:00.000 it'd be administrator at ogit. prod. It's getting here my lab environment. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 118 04:54.640 --> 05:00.000 it'd be administrator at ogit. prod. It's getting here my lab environment. And 119 05:00.000 --> 05:00.880 the password, I'll put 120 05:00.880 --> 05:05.180 that in. And then we click on action, you'll can ingest or receive vSphere 121 05:05.180 --> 05:06.560 server event logs. 122 05:06.560 --> 05:10.540 And for data ingestion, I'm going to go ahead and enable it. And for the 123 05:10.540 --> 05:11.600 schedule, let me go 124 05:11.600 --> 05:18.670 ahead and have it do it today at 105 PM. And then I'll have it end today as 125 05:18.670 --> 05:20.720 well at 5 PM. And the 126 05:20.720 --> 05:24.480 interval value of the schedule, let me go ahead and say every about 10 minutes. 127 05:24.480 --> 05:25.200 Also include the 128 05:25.200 --> 05:29.440 vSphere server event logs, scroll down, and that looks good. So we'll click on 129 05:29.440 --> 05:30.720 okay. And if that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 129 05:29.440 --> 05:30.720 okay. And if that 130 05:30.720 --> 05:34.490 went well, this should change to a little green checkmark here. As soon as it 131 05:34.490 --> 05:35.600 makes the connection, 132 05:35.600 --> 05:39.260 and we have that connector working between 40 analyzer and my vSphere 133 05:39.260 --> 05:40.480 environment. So I'm going 134 05:40.480 --> 05:45.110 to go ahead and bounce off that tab for a moment, go back to active connectors, 135 05:45.110 --> 05:46.000 scroll down, 136 05:46.000 --> 05:50.390 and survey says it is a green. That's fantastic. So now we have that connector 137 05:50.390 --> 05:51.440 in place as well 138 05:51.440 --> 05:54.720 that we can use. So based on the types of connectors that are active and 139 05:54.720 --> 05:55.200 available, 140 05:55.200 --> 05:58.140 that's going to control what actions we can do based on which devices we're 141 05:58.140 --> 05:59.440 operating with. So 142 05:59.440 --> 06:03.440 here we can interact with virus total. We have some logs we can take from v WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 142 05:59.440 --> 06:03.440 here we can interact with virus total. We have some logs we can take from v 143 06:03.440 --> 06:04.560 Sphere. We have the 144 06:04.560 --> 06:07.640 local connector for the 40 analyzer itself. We have the ForteGuard connector 145 06:07.640 --> 06:08.240 for ForteGuard 146 06:08.240 --> 06:12.120 services up in the cloud. And we have three devices connected with the 40 us 147 06:12.120 --> 06:12.720 connector, 148 06:12.720 --> 06:17.200 effectively meaning the 40 analyzer can interact with the automation and the 149 06:17.200 --> 06:18.320 stitches over on the 150 06:18.320 --> 06:22.320 40 gates. And as an example of some of the options we could have based on the 151 06:22.320 --> 06:23.760 connector we're using, 152 06:23.760 --> 06:27.230 let's just for a moment go to playbook tab here. I'm going to create a new 153 06:27.230 --> 06:28.240 playbook just for the 154 06:28.240 --> 06:31.880 purpose of showing you based on the connector that we're using the options that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 154 06:28.240 --> 06:31.880 purpose of showing you based on the connector that we're using the options that 155 06:31.880 --> 06:33.040 are available. So I 156 06:33.040 --> 06:36.590 can click right here new playbook created from scratch. And then we can choose 157 06:36.590 --> 06:37.440 our trigger. We'll 158 06:37.440 --> 06:41.250 cover triggers in more detail in next video. So I'll say on demand and click on 159 06:41.250 --> 06:42.240 save, which basically 160 06:42.240 --> 06:45.920 means this playbook can be launched manually by an administrator. And then 161 06:45.920 --> 06:47.040 based on this playbook 162 06:47.040 --> 06:50.340 being triggered, we can specify the follow up action. So we can take cancel 163 06:50.340 --> 06:51.120 that for a moment, 164 06:51.120 --> 06:55.680 we can just grab any dots here and create a subsequent action out of them. And 165 06:55.680 --> 06:56.080 it doesn't 166 06:56.080 --> 06:58.790 matter which one you use, you can use the top one, the bottom one, the right 167 06:58.790 --> 07:00.000 one doesn't really matter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 167 06:58.790 --> 07:00.000 one doesn't really matter. 168 07:00.000 --> 07:04.140 So we'll drag it over here and now because I do have connectors in place with 169 07:04.140 --> 07:05.040 the local host, 170 07:05.040 --> 07:09.780 the 40 analyzer itself with 40 us, which is the 40 gate firewalls and Forte 171 07:09.780 --> 07:11.120 Guard up in the cloud. 172 07:11.120 --> 07:15.200 And we also have connectors over with virus total. I could leverage any of 173 07:15.200 --> 07:16.240 those including vSphere. 174 07:16.240 --> 07:19.040 And again, depending on the connector we're using is going to depend on the 175 07:19.040 --> 07:19.920 actions we could take. 176 07:19.920 --> 07:24.810 So for example, if we said local host, which is the 40 analyzer itself, so I'll 177 07:24.810 --> 07:25.680 put demo here 178 07:25.680 --> 07:28.800 for the name and then for the connectors, the local connector. And then for the 179 07:28.800 --> 07:29.360 action, check 180 07:29.360 --> 07:33.450 it out. These are all the actions that the 40 analyzer can do on itself WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 180 07:29.360 --> 07:33.450 it out. These are all the actions that the 40 analyzer can do on itself 181 07:33.450 --> 07:34.560 effectively as it 182 07:34.560 --> 07:39.280 interacts with its own 40 analyzer brain. So update and asset and identity, get 183 07:39.280 --> 07:39.760 events, 184 07:39.760 --> 07:43.180 etc, etc, etc. And the list goes on. So if we change this, for example, do 185 07:43.180 --> 07:43.840 cancel 186 07:43.840 --> 07:48.170 and let's create a different action and let's go ahead and use 40 us as the 187 07:48.170 --> 07:48.960 connector. So I'll 188 07:48.960 --> 07:52.980 type in demo there. Now that 40 us is the connector, we can specify the device 189 07:52.980 --> 07:53.440 to use 190 07:53.440 --> 07:57.850 and then the automation. And an incoming web hook call is the interaction 191 07:57.850 --> 07:59.680 between the 40 analyzer 192 07:59.680 --> 08:04.240 and what the 40 gate or the security fabric of 40 gates have configured in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 192 07:59.680 --> 08:04.240 and what the 40 gate or the security fabric of 40 gates have configured in 193 08:04.240 --> 08:05.040 their automation as 194 08:05.040 --> 08:09.600 far as stitches go. So for device ID, I'll go ahead and select HQ firewall one, 195 08:09.600 --> 08:10.080 and then we'll click 196 08:10.080 --> 08:14.050 on okay. As another example, based on the connector we're working with, if we 197 08:14.050 --> 08:15.200 remove the tasks that 198 08:15.200 --> 08:18.500 we just put in there and then we grabbed an edge there and brought it over, let 199 08:18.500 --> 08:19.440 's go ahead and 200 08:19.440 --> 08:23.520 let's do how about virus total. So it's like virus total. I'll type in demo for 201 08:23.520 --> 08:23.920 this. It's 202 08:23.920 --> 08:27.100 going to use the virus total connector. So here for the actions, virus total, I 203 08:27.100 --> 08:27.760 have query IP, 204 08:27.760 --> 08:31.190 query domain and so forth. So if we click then cancel there and we used a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 204 08:27.760 --> 08:31.190 query domain and so forth. So if we click then cancel there and we used a 205 08:31.190 --> 08:32.400 different connector, 206 08:32.400 --> 08:35.080 so we'll scroll down and click on vSphere. I'll just label this demo for the 207 08:35.080 --> 08:35.600 moment. Again, 208 08:35.600 --> 08:38.180 we're just focusing on the various connectors and what we can do with them. And 209 08:38.180 --> 08:38.960 then for the action, 210 08:38.960 --> 08:42.590 here we have the action of ingest event log to 40 analyzer from a vSphere 211 08:42.590 --> 08:43.600 server and click on 212 08:43.600 --> 08:46.430 okay. And then I click on cancel. I don't want to save this new playbook. And 213 08:46.430 --> 08:47.040 we took a look at 214 08:47.040 --> 08:50.040 another example. Let's go ahead and let's look at this one right here, a 215 08:50.040 --> 08:51.200 playbook called incident 216 08:51.200 --> 08:55.710 dash run report. So it's an on demand trigger. It would regenerate a report. In 217 08:55.710 --> 08:56.400 fact, we can't 218 08:56.400 --> 08:59.870 edit this because it's a built in one. But what we can do is we could right 219 08:59.870 --> 09:01.440 click and click on clone WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 219 08:59.870 --> 09:01.440 click and click on clone 220 09:01.440 --> 09:04.320 and it'll give us the chance to edit and take a look at the details. So here, 221 09:04.320 --> 09:04.880 if we take a look 222 09:04.880 --> 09:08.990 at this run report task, we edit it and she's in the local connector, the 223 09:08.990 --> 09:09.840 action is run report, 224 09:09.840 --> 09:12.940 we still saw the report we want to run. So we'll cancel that. We looked at the 225 09:12.940 --> 09:14.000 attached data to 226 09:14.000 --> 09:18.270 incident. Effectively, it would run the report and then attach that report to 227 09:18.270 --> 09:19.200 the incident. And 228 09:19.200 --> 09:23.940 this playbook, when we execute this, we do that for us. So generate the report 229 09:23.940 --> 09:24.400 and then attach 230 09:24.400 --> 09:27.850 that report to an incident. So as an example, if we took this playbook, still 231 09:27.850 --> 09:28.640 we're reading this 232 09:28.640 --> 09:32.330 run report now to incident, we'll click on OK. And then if we're working with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 232 09:28.640 --> 09:32.330 run report now to incident, we'll click on OK. And then if we're working with 233 09:32.330 --> 09:32.960 our incidents, 234 09:32.960 --> 09:36.690 for example, under incidents and events, good incidents, let's just grab how 235 09:36.690 --> 09:37.440 about this right 236 09:37.440 --> 09:40.680 here, right click and say, we want to go into analysis mode. And then from here 237 09:40.680 --> 09:41.680 , we get execute 238 09:41.680 --> 09:45.680 playbook and simply run that playbook. So if we click on close for a moment, if 239 09:45.680 --> 09:46.400 we scroll down on 240 09:46.400 --> 09:50.420 the right hand side here, currently, it's not showing any playbooks executed in 241 09:50.420 --> 09:51.120 association with 242 09:51.120 --> 09:54.870 this incident, but we could go and click right here on execute playbook. And I 243 09:54.870 --> 09:56.000 'm going to go to the 244 09:56.000 --> 09:59.720 modified time column and sort by that. And let me look for the one we just made 245 09:59.720 --> 10:00.480 . I think it's this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 245 09:59.720 --> 10:00.480 . I think it's this 246 10:00.480 --> 10:04.420 one run report and add to incidents, we can select that, run it and then click 247 10:04.420 --> 10:05.120 on OK. And 248 10:05.120 --> 10:09.320 effectively, what's going to do are the instructions in that playbook. So here 249 10:09.320 --> 10:10.080 it's showing us the 250 10:10.080 --> 10:13.360 details of what's happening. There's the name of the playbook, the trigger was 251 10:13.360 --> 10:14.240 a manual trigger. So 252 10:14.240 --> 10:18.560 we launched it manually. And it failed as shown right here. And I think the 253 10:18.560 --> 10:19.760 reason it failed is 254 10:19.760 --> 10:23.850 because I didn't specify the actual report to run. So let me go ahead and edit 255 10:23.850 --> 10:24.880 that playbook by 256 10:24.880 --> 10:28.550 going back to automation. And right here, we'll go back to run report and add 257 10:28.550 --> 10:29.440 to instant. And 258 10:29.440 --> 10:33.680 let me edit this and specify which report to run. It'll be helpful. So I'll go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 258 10:29.440 --> 10:33.680 let me edit this and specify which report to run. It'll be helpful. So I'll go 259 10:33.680 --> 10:34.960 ahead and listen to 260 10:34.960 --> 10:38.970 our IPS report. Now the reason some reports are showing here and others aren't 261 10:38.970 --> 10:39.680 is that it has to 262 10:39.680 --> 10:44.440 have caching enabled on that report to be included as part of a playbook. So I 263 10:44.440 --> 10:45.200 'm just going to 264 10:45.200 --> 10:49.040 choose one of these that's already cached and click on OK and click on OK again 265 10:49.040 --> 10:49.760 . And let's try 266 10:49.760 --> 10:53.280 that again. So go back to our incidents. Just go and grab a random one. How is 267 10:53.280 --> 10:54.160 this right there? We'll 268 10:54.160 --> 10:58.520 analyze it and scroll down. So currently no executed playbooks. We'll click 269 10:58.520 --> 10:59.520 here on execute playbook. 270 10:59.520 --> 11:02.790 We'll go and launch run report and add to instant. Click on OK. And it'll give WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 270 10:59.520 --> 11:02.790 We'll go and launch run report and add to instant. Click on OK. And it'll give 271 11:02.790 --> 11:04.160 us the status playbook 272 11:04.160 --> 11:08.600 as it runs. And here's those details right here. And it failed. So here's 273 11:08.600 --> 11:09.840 showing in the details 274 11:09.840 --> 11:15.220 error and parsing schedule parameters. Time period. I'll get it included. Let 275 11:15.220 --> 11:15.680 me go back to 276 11:15.680 --> 11:20.370 cancel and close. We'll go back to automation and we'll edit run report and add 277 11:20.370 --> 11:21.280 to instant. And 278 11:21.280 --> 11:25.040 let's edit the details here. So time period. Yep. I should go ahead and specify 279 11:25.040 --> 11:25.680 time period. I'll 280 11:25.680 --> 11:29.370 say this week and click on OK and OK. And let's try that one more time. We'll 281 11:29.370 --> 11:30.960 go back to an incident. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 281 11:29.370 --> 11:30.960 go back to an incident. 282 11:30.960 --> 11:34.640 Just grab one, double click on it to go into analysis mode. We'll scroll down 283 11:34.640 --> 11:35.200 to make sure we 284 11:35.200 --> 11:38.830 don't have any playbooks that already get run. Also, it would show us here if 285 11:38.830 --> 11:39.440 we had several 286 11:39.440 --> 11:42.740 playbooks that were launched against an associate with this incident. It would 287 11:42.740 --> 11:43.680 show up here. So we'll 288 11:43.680 --> 11:46.610 do an execute playbook. And here it is right here. Run report and add to 289 11:46.610 --> 11:47.680 instant. So we'll go ahead 290 11:47.680 --> 11:51.520 and click on run and OK. All right. So it's kicked off and it should be 291 11:51.520 --> 11:52.800 generating the incident 292 11:52.800 --> 11:57.870 report. And then it should be associating that with the incident. All right. So 293 11:57.870 --> 11:58.560 the report was 294 11:58.560 --> 12:02.330 generated. That's great news. And it attached it. Fantastic. So we should see WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 294 11:58.560 --> 12:02.330 generated. That's great news. And it attached it. Fantastic. So we should see 295 12:02.330 --> 12:03.040 this test here in 296 12:03.040 --> 12:08.360 just a moment, say success, which it does. So if we close that and close that 297 12:08.360 --> 12:08.640 and here in our 298 12:08.640 --> 12:11.800 playbooks, if we just click on refresh, it's going to show us that that 299 12:11.800 --> 12:13.200 playbook was run. And also 300 12:13.200 --> 12:17.330 that report is now associated with that incident. Anybody want to take a look 301 12:17.330 --> 12:18.640 at the reports individually, 302 12:18.640 --> 12:22.930 we get on reports, generate reports, and there's our report right there. So the 303 12:22.930 --> 12:23.680 key takeaway from 304 12:23.680 --> 12:29.990 this video is regarding automation on the 40 analyzer. It depends a lot on what 305 12:29.990 --> 12:30.960 active connectors we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 305 12:29.990 --> 12:30.960 active connectors we 306 12:30.960 --> 12:35.950 have in place that are usable. So if we don't have connectors, for example, 40 307 12:35.950 --> 12:36.880 mail or 40 web 308 12:36.880 --> 12:40.800 or other components, we won't be able to interact or have the 40 analyzer 309 12:40.800 --> 12:42.240 interact with those devices. 310 12:42.240 --> 12:52.240 [BLANK_AUDIO]