Skip to main content

Cyware Orchestrate

Rerun Playbooks from Run Logs

You can rerun playbooks from run logs in two ways:

  1. Rerun entire Playbook

  2. Rerun Playbook from a Node

Before you Start

Ensure that you have the Run Playbooks permission.

Rerun entire Playbook

You can rerun a playbook from the run logs page when a playbook encounters an error or if you want to rerun it from the start node.

Steps

To rerun the entire playbook, do the following.

  1. Navigate to Main Menu > Run Logs.

  2. Find the run log for the playbook you want to rerun and click the three dots icon.

    • Run Playbook: Save changes and run the playbook immediately with an empty JSON dictionary as input.

    • Run with Input: Save the changes and run the playbook by providing input for playbook execution. A new run log is generated, and the playbook begins to execute. This will open the Provide Input For Playbook Execution window when you can provide the following data as input for the playbook to run.

      • Manual Input: Enter JSON data for manual input. You can input data up to 4 MB. You can also import up to 64 MB of data from a JSON file.

        For example, if the data entered in manual input is { "url": "www.cyware.com" }, then you can use ${event::data::url} in the input field of a Playbook node to fetch the value of url passed at the run-time.

      • Event: Select a past event that has triggered this Playbook and reuse its event data for the Playbook execution. The preview displays event data of up to 4 MB. You can also download data between 4 MB and 64 MB size for offline analysis.

        For example, you can select a past event such as phishing, and execute a Playbook by using its event data.

      • Playbook Run Log: Select a Playbook run log from the drop-down list to reuse the manual input or event data that has executed the Playbook in the past. The preview displays run logs data of up to 4 MB. You can also download data between 4 MB and 64 MB size for offline analysis.

        For example, you can select a run log such as May 06,2022, 06:00 PM to reuse its manual input such as "a=5" to execute the Playbook.

  3. Click Refresh to preview the live playbook execution logs.

Rerun Playbook from a Node

Notice

This feature is available in Orchestrate from the release version v3.5.2 and later.

You can rerun a playbook from a specific node to recover from errors in playbook execution without restarting the entire playbook. This method utilizes data from nodes that ran successfully and resumes the playbook execution from the node where the error occurred.

You can rerun playbook execution when the playbook encounters an error, system error, or achieves partial success during the initial run.

Limitations

There are certain scenarios where a playbook rerun from a node is not possible:

  • Node Removal: You cannot rerun a playbook from a specific node if the node from which you intend to rerun the playbook has been deleted or removed from the playbook.

    The rerun activity cannot be performed

  • Start Node: You cannot rerun a playbook from the start node of the playbook.

  • Playbook Status: You cannot rerun a playbook from a node if the playbook status is Waiting, On-Hold, In-Queue, Terminated, or In-Progress.

  • Unstarted Execution: You cannot rerun a playbook from a node if a playbook node has not started execution and lacks any status information.

  • Run Log Availability: The rerun activity cannot be performed if the run log is deleted or purged. To configure the duration for purging run logs, see Purge Logs.

Steps

To rerun the execution of a playbook that encountered an error, system error, or partial success status, do the following:

  1. Navigate to Main Menu > Run Logs.

  2. Select the run log for the playbook with an Error, System Error, or Partial Success status that you want to rerun from the list.

  3. Hover on the node from which you want to rerun the playbook execution to view Rerun from this Node. When you perform a rerun from a node, all the data from the previous nodes that were successfully executed will be reused. For example, if you click Rerun from this Node on the third node of a four-node playbook, the data from nodes 1 and 2 will be reused to resume the playbook execution from the third node.

  4. Click Rerun from this Node from a required node to rerun the playbook run. This creates a new run log and navigates you to the new run log page to rerun the playbook execution. The new run log automatically references and reuses data from the old run log.

  5. Click Refresh to preview the live playbook execution. The new run log shows the reused data from the previous run log as an accordion. The input and output data from the previously executed nodes can be viewed in the reused data.

  6. Click Reused Data from RL ID - #<runlog-id> to view the reused data. You can click on the reused data link to navigate to the old run log details page. The redirection link is created when all data from the previous run log is successfully referenced and reused.

    You can use a reused run log as input for a playbook and execute it manually. However, the run log does not include the playbook input data because the start node is not referenced. To know how to run playbooks using playbook run logs, see Run a Playbook Manually.

Note

The Rerun from this Node button will not be accessible for the nodes that are deleted in the latest playbook version.