Export Run Logs
Exporting run logs enables analysts to perform auditing and offline analysis of Playbook executions. You can analyze the execution details, errors, mode of Playbook trigger (manual or automated), and more.
You can specify a date range, and export the run logs for all the Playbooks executed within that date range. To export a set of run logs based on specific parameters (for example, Playbook status, action, and more), filter them using Show Filters on the Run Logs listing page. Once the filters are applied, you can specify the date range and export the run logs. You can download the exported file under Informational Notifications.
The exported run logs will consist of the following details:
Playbook ID: The unique ID of a playbook. For example, PL435675
Playbook name: The name of a playbook. For example, Threat Hunting
Run Log ID: Unique ID associated with each run of a playbook.
Last run time: Timestamp of the last playbook execution.
Run duration: Duration of the playbook execution.
Run by user: The user that has executed the playbook.
Playbook status: The run status of a playbook. For example, in progress.
Triggered method: The execution method of the playbook. For example,manual or automated.
Count of the Sub-Playbooks: The count of the associated sub-playbooks.
Before you Start
Ensure you have the View Run Logs permission to view and export the run logs.
Steps
To export run logs:
Go to Main Menu > Run Logs.
Click Export in the top-right corner.
Choose the export type from the dropdown. The supported file types are CSV and XLS.
Choose a date range from the date picker.
Note
Run logs can be exported up to a maximum of 50,000 run logs or for a maximum duration of 31 days. By default, the current day is selected.
Click Export.
The run logs for the specified date range are exported. You can download the exported file under Informational Notifications.