--- title: "Executing a Playbook" slug: "executing-a-playbook" description: "This article describes how to execute Playbooks that use Mailbox, Timer, UserAction, WebHook, Group, Indicator, Case, Track, and Victim Triggers." tags: ["Orchestration and Automation"] updated: 2025-03-10T15:29:24Z published: 2025-03-10T15:29:24Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Executing a Playbook ## Overview A Trigger is an event that initiates the actions defined within a [Playbook](https://knowledge.threatconnect.com/docs/playbooks) in ThreatConnect®, which can vary depending on the [type of Trigger](https://knowledge.threatconnect.com/docs/parts-of-a-playbook#triggers) used in the Playbook. This article covers how to execute Playbooks that use Mailbox, Timer, UserAction, WebHook, Group, Indicator, Intel Requirement, Case, and Victim Triggers. NoteIn addition to the methods described in this article, you can create and use a [Run Profile](https://knowledge.threatconnect.com/docs/playbooks-run-profiles) to perform a sample execution of a Playbook. ## Before You Start ### User Roles - To view Playbooks, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles). - To execute Playbooks, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer. ### Prerequisites - To execute a Playbook, you must first [configure](https://knowledge.threatconnect.com/docs/designing-a-playbook) and [activate](https://knowledge.threatconnect.com/docs/activating-a-playbook) the Playbook - To have access to Playbooks, turn on the Playbooks system setting for your ThreatConnect instance on the **System Settings**screen (must be a System Administrator to perform this action). ## Executing Playbooks ### Playbooks With a Mailbox Trigger Playbooks with a [Mailbox Trigger](https://knowledge.threatconnect.com/docs/playbooks-the-mailbox-trigger) execute when an email is received in the Trigger’s target mailbox. The email’s contents will then be passed along to any downstream [Apps or Operators](https://knowledge.threatconnect.com/docs/parts-of-a-playbook) in the Playbook. To test the functionality of an active Playbook that uses a Mailbox Trigger, click **Send Email**![Send Email icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Send%20Email%20icon.png)at the top right of the [Playbook Designer](https://knowledge.threatconnect.com/docs/the-playbook-designer) (Figure 1). Your computer’s default mail client will open a new message with the target mailbox address listed in the **To:**field. Alternatively, click **Copy**![Copy icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Copy%20icon.png)to copy the target mailbox address to your computer’s clipboard so that you can paste it into an email message. ![Figure 1_Executing a Playbook_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Executing%20a%20Playbook_7.1.0.png) ### Playbooks With a Timer Trigger Playbooks with a [Timer Trigger](https://knowledge.threatconnect.com/docs/playbooks-the-timer-trigger) execute based on a set schedule (e.g., once a day, on the fifteenth of the month, etc.) defined in the Trigger’s **Schedule**and **Daily Time**parameters (Figure 2). ![A picture containing graphical user interface Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Executing%20a%20Playbook_7.7.1.png) For example, if you set the **Schedule**parameter to **Daily**and the **Daily Time**parameter to **09:30**, the Playbook will execute every day at 9:30 a.m. UTC. Note that the Coordinated Universal Time (UTC) time standard is used when configuring the **Daily Time** parameter. ### Playbooks With a UserAction Trigger A [UserAction Trigger](https://knowledge.threatconnect.com/docs/playbooks-the-useraction-trigger) lets you run Playbooks on demand while viewing the **Details** screen or drawer for Indicators, Intelligence Requirements, Groups, and Victims. You can also [execute Playbooks with a UserAction Trigger configured for Indicators when using Threat Graph](https://knowledge.threatconnect.com/docs/running-playbooks-in-threat-graph). NoteYou cannot execute UserAction Trigger–based Playbooks on the **Details**drawer for Signature, Email, and Task Groups; or Victims. #### Details Screen and Drawer On an object’s [**Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen) or **[](https://knowledge.threatconnect.com/docs/the-details-drawer)** [](https://knowledge.threatconnect.com/docs/the-details-drawer)[**Details**drawer](https://knowledge.threatconnect.com/docs/the-details-drawer)[](https://knowledge.threatconnect.com/docs/the-details-drawer)**[](https://knowledge.threatconnect.com/docs/the-details-drawer)**, the **Playbooks**card displays Playbooks with a UserAction Trigger configured for the object’s type (Figure 3). Click **Run playbook**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Run%20playbook%20icon.png)for a Playbook to execute it. ![Figure 3_Executing a Playbook_7.1.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Executing%20a%20Playbook_7.7.1.png) NoteThe **Trigger Name** column on the **Playbooks**card displays the name of the UserAction Trigger that will start the Playbook’s execution and, if available, the Playbook’s description. The **Status**column on the **Playbooks**card displays the Playbook’s status. The default status is **Ready**, which will change to **Complete**after the Playbook execution finishes. Depending on how the UserAction Trigger’s response body was configured, the **Playbooks**card will display the results of the Playbook’s execution in one of the following ways: - If the Trigger contains a response body and its **Render as Tip** checkbox was selected, the **Playbooks**card will display the response body as a tooltip, along with a status of **Complete**in the **Status**column for the Playbook (Figure 4). If the tooltip closes, hover over the![Page%20icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Page%20icon.png)icon on the **Playbooks**card to display the tooltip again. ![Figure%204_Executing%20a%20Playbook_7.4.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Executing%20a%20Playbook_7.7.1.png) - If the Trigger contains a response body, but its **Render as Tip**checkbox was not selected, the **Playbooks**card will display only a status of **Complete**in the **Status**column for the Playbook; it will not display the Trigger’s response body. - If the Trigger does not contain a response body, the **Playbooks**card will display a status of **Complete**in the **Status**column for the Playbook. #### Legacy Details Screen On an object’s [legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy), the **Playbook Actions**card will be displayed on the **Overview**tab if there is at least one active Playbook with a UserAction Trigger configured for the object’s type (Figure 5). Click **Run![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Run%20icon.png)**for a Playbook to execute it. ![Graphical user interface, application, Teams Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_Executing%20a%20Playbook_7.4.0.png) NoteThe **Name**column on the **Playbook Actions**card displays the name of the UserAction Trigger that will start the Playbook’s execution. The **Status**column on the **Playbook Actions**card displays the Playbook’s status. The default status is **Ready**, which will change to **Completed**after the Playbook execution finishes. Depending on how the UserAction Trigger’s response body was configured, the **Playbook Actions**card will display the results of the Playbook’s execution in one of the following ways: - If the Trigger contains a response body, but its **Render as Tip**checkbox was not selected, the **Playbook Actions**card will display the Trigger’s response body****in the **Status**column for the Playbook (Figure 6). ![A picture containing graphical user interface Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_Executing%20a%20Playbook_7.4.0.png) - If the Trigger contains a response body and its **Render as Tip** checkbox was selected, the **Playbook Actions**card will display the response body as a tooltip, along with a status of **Completed**in the **Status**column for the Playbook (Figure 7). f the tooltip closes, hover over **Completed**in the **Status**column to display the tooltip again. ![A picture containing graphical user interface Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%207_Executing%20a%20Playbook_7.4.0.png) - If the Trigger does not contain a response body, the **Playbook Actions**card will display a status of **Completed**in the **Status**column for the Playbook. NoteIf the Playbook does not fully complete its workflow after the amount of time specified for the UserAction Trigger’s **Timeout** parameter, the Trigger will time out and display a status of “Error 500”, but the Playbook will continue to run. If the **Render as Tip** checkbox was selected when configuring the Trigger, the tooltip will return a response after the entire Playbook workflow is complete. Associating a midstream App to the Trigger to generate an earlier response (i.e., before the Playbook workflow is complete) is not a supported workaround. ### Playbooks With a WebHook Trigger A [WebHook Trigger](https://knowledge.threatconnect.com/docs/playbooks-the-webhook-trigger) creates an HTTPS endpoint that can process nearly any piece of information that can be sent via HTTP. To execute an active Playbook with a WebHook Trigger, click **Execute Endpoint![Execute Endpoint icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Execute%20Endpoint%20icon.png)**at the top right of the Playbook Designer (Figure 8). Alternatively, click **Copy Endpoint URL**![Copy icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Copy%20icon.png)to copy the endpoint URL****and paste it into your browser’s search bar. ![A picture containing diagram Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%208_Executing%20a%20Playbook_7.4.0.png) You can also access the **Execute Endpoint![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Execute%20Endpoint%20icon.png)**and **Copy Endpoint URL**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Copy%20icon.png)icons on the [**Playbooks**screen](https://knowledge.threatconnect.com/docs/the-playbooks-screen) by hovering over the table row for an active Playbook with a WebHook Trigger. Doing so will display both icons in the **Name**column, below the endpoint URL (Figure 9). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%209_Executing%20a%20Playbook_7.7.1.png) ### Playbooks With a Group, Indicator, Case, Intel Requirement, or Victim Trigger Group, Indicator, Case, Intel Requirement, Track, and Victim Triggers represent the [Group, Indicator](https://knowledge.threatconnect.com/docs/the-threatconnect-data-model), [Case](https://knowledge.threatconnect.com/docs/workflow-cases), [Intelligence Requirement](https://knowledge.threatconnect.com/docs/intelligence-requirements), and [Victim](https://knowledge.threatconnect.com/docs/creating-victims) objects in ThreatConnect, respectively. Playbooks that use any of these Triggers will execute when a particular action is taken on an object of the type represented by the Trigger, based on how you configured the Trigger’s **Owners**and **Action Type**parameters (Figure 10). For example, a Playbook with a Host Trigger can be configured to execute when a new Host Indicator is created in your Organization and/or one or more of your Communities or Sources, and a Playbook with a Case Trigger can be configured to execute when the severity for a Workflow Case in your Organization has been set. ![A picture containing graphical user interface Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%2010_Executing%20a%20Playbook_7.7.1.png) The **Owners**parameter determines the [ThreatConnect owners](https://knowledge.threatconnect.com/docs/ownership-in-threatconnect) in which the Playbook can be executed. You must select at least one owner when configuring the Trigger. The **Action Type**parameter determines the action the Trigger will listen for. When the selected action takes place in one of the specified owners, the Trigger will start the Playbook. For example, if an Email Subject Indicator****Trigger is configured with **Create**as its **Action Type**and **Demo Organization**as its **Owner**, the Trigger will start the Playbook whenever an Email Subject Indicator is created in the owner named Demo Organization. See Table 1 for a list of values for the **Action Type**parameter and the supported Trigger types for each value. | Value | Supported Trigger Types | | --- | --- | | Create | Case, Group, Indicator, Intel Requirement, Victim | | Delete | Case, Group, Indicator, Intel Requirement, Victim | | New Results | Intel Requirement | | Security Label Applied | Group; Indicator, Victim | | Security Label Removed | Group; Indicator, Victim | | Set Resolution | Case | | Set Severity | Case | | Specific Status Set | Case | | Tag Applied | Case, Group, Indicator, Intel Requirement, Victim | | Tag Removed | Case, Group, Indicator, Intel Requirement, Victim | ### Playbooks With a Service Trigger Service Apps are microservices that constantly run in the background. Executing a Playbook that uses a Trigger Service will vary based on how you configure the Trigger Service and its corresponding Playbook Trigger. See [*Playbook Services*](https://knowledge.threatconnect.com/docs/playbook-services) for more information on creating Trigger Services. ## Stopping Playbook Executions You can stop Playbook executions from the **Executions**pane of the [Playbook Designer](https://knowledge.threatconnect.com/docs/the-playbook-designer). See the [“Stopping a Playbook Execution” section of *Playbook Executions*](/v1/docs/playbook-executions#stopping-a-playbook-execution) for more information. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20115-01 v.04.B ## Related - [Parts of a Playbook](/parts-of-a-playbook.md) - [Playbook Executions](/playbook-executions.md) - [Playbook Services](/playbook-services.md) - [Playbooks: Run Profiles](/playbooks-run-profiles.md) - [The Details Screen](/the-details-screen.md) - [The Mailbox Trigger](/playbooks-the-mailbox-trigger.md) - [The Playbook Designer](/the-playbook-designer.md) - [The Playbooks Screen](/the-playbooks-screen.md) - [The Timer Trigger](/playbooks-the-timer-trigger.md) - [The UserAction Trigger](/the-useraction-trigger.md) - [The WebHook Trigger](/the-webhook-trigger.md)