WEBVTT

1
00:00.000 --> 00:04.090
In this video, we get to take a look at the use of playbook monitors, which can

2
00:04.090 --> 00:04.720
help us get a big

3
00:04.720 --> 00:08.950
picture view of which playbooks have run and how often they have run. So let's

4
00:08.950 --> 00:09.920
head once again down

5
00:09.920 --> 00:14.410
to the 40 analyzer and take a look. So here at the 40 analyzer for automation,

6
00:14.410 --> 00:14.960
once again, we're

7
00:14.960 --> 00:18.430
going to go to incidents and events. And then below incidents and events, we're

8
00:18.430 --> 00:20.080
going to go to automation.

9
00:20.080 --> 00:23.520
So here in automation, we have summary, which is not a bad idea. I was seeing,

10
00:23.520 --> 00:24.080
you know, how many

11
00:24.080 --> 00:28.610
playbooks have been executed and how many actions have taken place. And all of

12
00:28.610 --> 00:29.360
these have been

13
00:29.360 --> 00:32.320
the last couple of days, while I've been preparing for this skill. And then we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.360 --> 00:32.320
the last couple of days, while I've been preparing for this skill. And then we

14
00:32.320 --> 00:33.920
have our active connectors,

15
00:33.920 --> 00:37.820
which is the other devices we can interact with. We have virus total and the v

16
00:37.820 --> 00:38.960
Sphere connector.

17
00:38.960 --> 00:43.400
We have 40 OS devices, which is the 48 firewalls. We have the local connector

18
00:43.400 --> 00:43.680
and also a

19
00:43.680 --> 00:47.380
Fortigar. If we go to playbooks, here we have our playbooks, including ones

20
00:47.380 --> 00:48.560
that are built in and

21
00:48.560 --> 00:53.930
the ones that I created. And then we have the playbook monitor, which is going

22
00:53.930 --> 00:54.640
to show us

23
00:54.640 --> 00:59.110
the playbooks. And when they ran, what their triggers were, their start time,

24
00:59.110 --> 01:00.000
the end time.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:59.110 --> 01:00.000
the end time.

25
01:00.000 --> 01:02.800
And I'm going to go ahead and collapse the left hand side gives a little bit

26
01:02.800 --> 01:03.360
more room.

27
01:03.360 --> 01:06.690
So if we look at the status of these, we had a lot that were very successful

28
01:06.690 --> 01:07.920
because it was the same

29
01:07.920 --> 01:11.160
playbook that was running over and over again, based on various events that

30
01:11.160 --> 01:11.920
were coming in.

31
01:11.920 --> 01:15.770
And as a result, it created all those incidents that we were then able to go in

32
01:15.770 --> 01:16.480
and further run

33
01:16.480 --> 01:20.580
playbooks on for additional automation. So if we scroll down far enough, we're

34
01:20.580 --> 01:20.880
going to have

35
01:20.880 --> 01:25.680
some failed like right here. Look at the timestamps. That's what I was testing

36
01:25.680 --> 01:26.720
and working through

37
01:26.720 --> 01:30.700
a few of them. But the cool thing is, if they fail, the log messages can
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:26.720 --> 01:30.700
a few of them. But the cool thing is, if they fail, the log messages can

38
01:30.700 --> 01:32.160
indicate where it failed.

39
01:32.160 --> 01:36.100
So if we have a playbook with 15 or 16 tasks and it, you know, two or three of

40
01:36.100 --> 01:36.480
them failed,

41
01:36.480 --> 01:40.340
we just go into those specific tasks and tune them up. And also I've learned

42
01:40.340 --> 01:41.440
that it's a lot better

43
01:41.440 --> 01:46.670
to take a existing playbook and clone it and tweak it or create a new one from

44
01:46.670 --> 01:47.520
a template,

45
01:47.520 --> 01:50.210
because that's going to have a lot of the missing pieces rather than just

46
01:50.210 --> 01:51.600
creating one from scratch.

47
01:51.600 --> 01:55.110
So for example, this right here that failed, if we click on this little icon

48
01:55.110 --> 01:55.680
for detail,

49
01:55.680 --> 01:59.080
it'll give us the detail regarding that playbook. So it was on demand, which

50
01:59.080 --> 01:59.920
means we had to click

51
01:59.920 --> 02:05.920
into launch it. And the so here's the problem. It never generated the report.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:59.920 --> 02:05.920
into launch it. And the so here's the problem. It never generated the report.

52
02:05.920 --> 02:06.800
And as a result,

53
02:06.800 --> 02:10.520
it never attached that report to the incident. Maybe that report wasn't

54
02:10.520 --> 02:11.680
available or I'd messed

55
02:11.680 --> 02:14.870
with it somehow or taken off the caching. I'm not sure. And then even that's

56
02:14.870 --> 02:15.520
the problem. It

57
02:15.520 --> 02:18.620
couldn't create the report. So it couldn't attach that report to the incident.

58
02:18.620 --> 02:18.640
Stick

59
02:18.640 --> 02:21.260
look at another one scroll down. In fact, let's go to this right here with

60
02:21.260 --> 02:22.080
double click. And this

61
02:22.080 --> 02:26.020
is showing us fail. I think I created it or started creating it. And I ran a

62
02:26.020 --> 02:26.880
test run without all

63
02:26.880 --> 02:32.750
the details in it. So it did the trigger and then it failed. So for this one,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:26.880 --> 02:32.750
the details in it. So it did the trigger and then it failed. So for this one,

64
02:32.750 --> 02:33.520
based on the

65
02:33.520 --> 02:36.720
timestamp, that was early in the day for me when I started recording or

66
02:36.720 --> 02:38.560
starting doing some testing.

67
02:38.560 --> 02:42.260
And I just barely put the trigger in place. And I hadn't put in all the details

68
02:42.260 --> 02:43.200
. So that's the

69
02:43.200 --> 02:46.920
best reason this one failed. But most of these have been successful. So here's

70
02:46.920 --> 02:47.840
one for the vSphere

71
02:47.840 --> 02:51.270
connector. That's running every 10 minutes, it looks like based on the

72
02:51.270 --> 02:52.080
scheduling interval.

73
02:52.080 --> 02:55.670
Fantastic. And I'll make that column a little bit bigger as well. And for the

74
02:55.670 --> 02:56.320
columns, if we

75
02:56.320 --> 02:59.560
want to remove some columns, you can use the gear. And we can remove the ones

76
02:59.560 --> 03:00.400
that we don't need.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:59.560 --> 03:00.400
that we don't need.

77
03:00.400 --> 03:03.750
For example, start time and time if those aren't too critical, you can remove

78
03:03.750 --> 03:04.320
them. Or if you want

79
03:04.320 --> 03:07.360
to put it back to the defaults, just click right here and reset the default. So

80
03:07.360 --> 03:08.160
again, here at the

81
03:08.160 --> 03:12.100
summary, you can get a big picture look at like how many playbooks were

82
03:12.100 --> 03:13.280
executed and how many

83
03:13.280 --> 03:16.630
actions were executed. And then the playbook monitor is showing us the nitty

84
03:16.630 --> 03:17.600
gritty details.

85
03:17.600 --> 03:21.830
And then we can double click or click right here on the details icon to get

86
03:21.830 --> 03:22.960
more information on

87
03:22.960 --> 03:27.110
that playbook. And whether or not all of its tasks completed or not. And as one

88
03:27.110 --> 03:27.760
other example,

89
03:27.760 --> 03:32.250
I don't think we tested the virus total connector. So let's go to our playbooks
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:27.760 --> 03:32.250
I don't think we tested the virus total connector. So let's go to our playbooks

90
03:32.250 --> 03:33.920
. And here's one called

91
03:34.800 --> 03:38.830
get URL reputation. So we can just go ahead and run it right here. And let's

92
03:38.830 --> 03:39.600
say for the URL,

93
03:39.600 --> 03:44.400
we're going to do www.fordnet.com and click on OK. And that should run it.

94
03:44.400 --> 03:44.960
Because we have a

95
03:44.960 --> 03:48.820
connector out to virus total, that should succeed. We'll verify that here in

96
03:48.820 --> 03:50.000
just a moment. And

97
03:50.000 --> 03:53.940
sure enough, so on demand means we click the button to launch it. It was able

98
03:53.940 --> 03:54.880
to successfully

99
03:54.880 --> 03:59.000
get the data. And then this data by itself isn't too helpful unless we also

100
03:59.000 --> 04:00.560
associate for example,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:59.000 --> 04:00.560
associate for example,

101
04:00.560 --> 04:04.850
with an incident. So what we could do, for example, is take this playbook

102
04:04.850 --> 04:06.640
called get URL reputation,

103
04:06.640 --> 04:09.310
clone it, and then we get added on another action. So here I'll call it

104
04:09.310 --> 04:10.800
attached to incident. And for

105
04:10.800 --> 04:14.620
the action will attach data to incident. And I just like playbook starter here

106
04:14.620 --> 04:15.920
and click on OK.

107
04:15.920 --> 04:19.500
And now it's attached. So we should be able to go to an incident manually run

108
04:19.500 --> 04:20.240
this playbook.

109
04:20.240 --> 04:24.080
And it'll go out and it'll gather the information in this case, the reputation

110
04:24.080 --> 04:25.120
based on the URL

111
04:25.120 --> 04:28.880
and attach that data to the incident. So we'll click on OK. And we'll go back

112
04:28.880 --> 04:29.840
to our incidents.

113
04:29.840 --> 04:33.680
Let's go ahead and grab one. How about this one right here? We'll double click
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:29.840 --> 04:33.680
Let's go ahead and grab one. How about this one right here? We'll double click

114
04:33.680 --> 04:34.080
and we'll scroll

115
04:34.080 --> 04:38.220
down and see what playbooks have already run. So no playbooks yet. We'll click

116
04:38.220 --> 04:39.040
on execute playbook.

117
04:39.040 --> 04:43.600
And I think we call it copy of you get URL reputation. So we'll launch that

118
04:43.600 --> 04:44.560
click on OK.

119
04:44.560 --> 04:48.800
Oh, and because we just created it, it needs a little bit of time to complete

120
04:48.800 --> 04:49.760
the parsing. Also,

121
04:49.760 --> 04:54.190
I didn't specify the URL. So if there's a URL in this incident, perhaps it

122
04:54.190 --> 04:54.800
would pull that,

123
04:54.800 --> 04:58.460
but I didn't specify any variables. So let me go ahead and run that one more

124
04:58.460 --> 04:59.680
time and put the URL

125
04:59.680 --> 05:04.190
for net.com and click on OK. All right, so this is started the playbook. So I
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
04:59.680 --> 05:04.190
for net.com and click on OK. All right, so this is started the playbook. So I

126
05:04.190 --> 05:05.280
've got the data and

127
05:05.280 --> 05:09.180
attached it to the incident. Hooray. So again, the key here with playbooks, let

128
05:09.180 --> 05:10.240
me refresh this,

129
05:10.240 --> 05:13.560
is that once we have playbooks that we're going to use all the time, it makes

130
05:13.560 --> 05:14.080
it very,

131
05:14.080 --> 05:17.920
very easy to be consistent and get the information we need with just a couple

132
05:17.920 --> 05:18.720
clicks of the button.

133
05:18.720 --> 05:23.560
Or if they're automated based on events or incidents, they can automatically

134
05:23.560 --> 05:24.320
run based on those

135
05:24.320 --> 05:25.680
situations occurring.