Multi-Environment Orchestration: Executing Playbook Apps Through a Firewall

Overview

Multi-environment orchestration allows ThreatConnect^® users that have an Environment Server behind a firewall to use their instance to communicate with that server and run Playbook Apps and Services inside their firewall.

Before You Start

Enabling Remote Execution for an App

System Administrators can follow these steps to enable remote execution for an App on the TC Exchange™ Settings screen:

1. Log into ThreatConnect with a System Administrator account.
2. On the top navigation bar, hover over Settingsand select TC Exchange Settings. The Installed tab of the TC Exchange Settings screen will be displayed.
3. Locate the desired App and click the vertical ellipsis in the Options column. A menu will be displayed.
4. Toggle on the Allow Remote Execution slider in the menu.

Configuring Remote Execution for a Playbook App

1. On the top navigation bar, click Playbooks. The Playbooks screen will be displayed.
2. Create a new Playbook or open an existing one.
3. Click the Menuicon at the upper-right corner of the Playbook App to verify whether remote execution is enabled for it, as detailed in the “Enabling Remote Execution for an App” section. If an Environment option is displayed (Figure 1), then remote execution is enabled.

   

    

4. Select Environment from the menu displayed in Figure 1. A window like Figure 2 will be displayed for the App.

    

   • Remote Environment: Select the Environment from which the App is to be executed.
   • Click the SAVE button.

The Environmenticon will now be displayed at the upper-left corner of the App. Hovering over the Environmenticon will display the selected remote Environment from which the App is to be executed (Figure 3).

After the Playbook executes, Apps that executed remotely will be displayed in the Execution Graph pane on the Executions screen with the Environmenticon at the upper-left corner of the App, and the remote Environment will be listed in the Execution Details pane on the Executions screen (Figure 4).

Configuring Remote Execution for a Service

1. Log into ThreatConnect with an Organization Administrator or System Administrator account.
2. On the top navigation bar, hover over Playbooks, and select Services. The Services tab of the Playbooks screen will be displayed.
3. Create a new Playbook Service or open an existing one.
4. Click the vertical ellipsisto the right of the desired Service and select Environment. The Environment window for that Service will be displayed (Figure 5).
   Note

   For Organization Administrators, the vertical ellipsiswill be displayed only for Services that they or another Organization Administrator in their Organization created.

   

    

   • Select the Environment from which the Service is to be executed.
   • Click the SAVE button.

Service Triggers that have been configured for remote execution will display an Environmenticon at the upper-left corner of the Trigger when it is added to the Playbook Designer (Figure 6).

ThreatConnect^® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.

20064-01 v.06.A