---
title: "Settings Knowledge Base Article | ThreatConnect"
slug: "settings"
description: "This article describes the options available via the Settings menu in the upper-right corner of the Playbook Designer."
updated: 2022-08-29T15:55:42Z
published: 2022-08-29T15:55:42Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Settings

Click the **Settings** ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/settings-image-0ds6yp01.png) icon in the upper-right corner of the **Playbook Designer** to configure the Playbook’s settings (Figure 1).

![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/settings-image-vpi1mdz7.png)

## Run As

Use the dropdown menu to select the name of the user under which the Playbook should execute. This menu will be disabled if the **Run as current user**checkbox was enabled for a [UserAction Trigger](/v1/docs/playbooks-the-useraction-trigger) in the Playbook.

## Log Level

Use the dropdown menu to select the log level for the Playbook. Table 1 describes each log level, from least to most granular.

| Logging Level | Description |
| --- | --- |
| ERROR | The **ERROR** log level will record only serious issues, such as a failure of an important process within the execution of a Playbook or Playbook App. The Playbook or Playbook App will still be able to run, but the problem, such as a dropped database connection or the inability to access a file or service, will require remediation in the near future. |
| WARN | The **WARN** log level will record unexpected and unusual, but not necessarily serious, problems in the execution of a Playbook or Playbook App, such as an attempt to invoke a service that resulted in failures before a successful connection on an automatic retry. It is unknown whether the issue will persist or recur. Warnings should be investigated, but are typically not urgent. |
| INFO | The **INFO** log level will record normal behavior and milestones for the execution of a Playbook or Playbook App, such as the start or exit of an App or the submission of an Indicator to a SIEM. |
| DEBUG | The **DEBUG**log level records detailed diagnostic information about the execution of a Playbook or Playbook App. For example, an App with this logging level may provide additional telemetry about a network or proxy connection. |
| TRACE | The **TRACE**log level records very detailed diagnostic information about the execution of a Playbook or Playbook App. This log level provides the most granular information and is used to capture every possible detail about the Playbook or Playbook App’s behavior. |

Log levels cascade; in other words, any log level will capture details at its own level and at all less granular log levels. For instance, **INFO** will capture **WARN** and **ERROR** messages, but exclude **DEBUG** and **TRACE** messages. Apps written in Python do not distinguish between **DEBUG** and **TRACE** log levels. Either can be used during Playbook design with the same effect.

Setting the log level for a Playbook App to **DEBUG** or **TRACE** activates input- and output-parameter value capture in the **Input** and **Output** tabs, respectively, for that App’s step in the **Execution Details**pane of the **Executions**screen for the Playbook (Figure 2 and Figure 3).

![Graphical user interface Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/settings-image-8o5egjfz.png)

![Graphical user interface Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/settings-image-w6sw5cr2.png)

See [*Playbook Executions*](/v1/docs/playbook-executions) for more information on the **Execution**screen.

NotePlaybook executions that fail in the **TRACE** or **DEBUG** log level will automatically become cached as an interactive session. Users can then investigate the failed Playbook in an **Interactive Mode** session. All session-state information at the time of the failure can be reviewed and analyzed for root causes. For more information about **Interactive Mode**, see [*Interactive Playbooks*](/v1/docs/interactive-playbooks)*.* [](/v1/docs/interactive-playbooks-overview)

During Playbook development, it is recommended that the log levels of individual Apps be set to **DEBUG** or **TRACE** in order to maximize the amount of detail available in the logs on the **Execution**screen. Once a Playbook is ready for production, it is recommended that the Apps’ log levels be set to **INFO**, **WARN**, or **ERROR**. Leaving the log level for an App set to **DEBUG** or **TRACE** will generate excessive amounts of information in a high-volume environment and may affect system performance. Similarly, it is recommended to set the log level for the Playbook itself to **INFO** or **WARN**.

## Server

Use the dropdown menu to select the server or group of servers on which the Playbook should execute. If a private server is available to the user’s Organization, a lock icon will be displayed next to the server’s name. In a multi-tenant instance of ThreatConnect, private servers are dedicated instances on which users in an Organization can run a Playbook rather than have the Playbook execute through the queue of the pool of public servers (i.e., the Default Server Pool). Private servers should be used for Playbooks of priority or performance requirements that necessitate their execution outside of the Default Server Pool.

## Priority

Use the dropdown menu to select the priority level (**High**, **Medium**, or **Low**) for the Playbook. Playbook priority level is used to influence a Playbook’s position in the execution queue. When all Playbooks in the execution queue (either in the Default Server Pool or on a private server) have the same priority level, they will go through the queue on a first-in, first-out (FIFO) basis. When a Playbook of higher priority enters the queue, its execution will take precedence over any lower-priority Playbooks waiting in the queue, regardless of existing queue order. When multiple Playbooks of a given priority level are in the queue, they will execute on a FIFO basis within their priority level.

For example, if there are two high-priority Playbooks, three medium-priority Playbooks, and four low-priority playbooks in the queue, the two high-priority Playbooks will execute first, in the order in which they were entered in the queue (i.e., FIFO), the three medium-priority Playbooks will execute next in FIFO order, and then the four low-priority Playbooks will execute last in FIFO order. If, while the medium-priority Playbooks are executing, another high-priority Playbook enters the queue, the high-priority Playbook will execute after the current execution completes, and then the queue will go back to executing the medium-priority Playbooks. The default priority level for a Playbook is **Medium**.

NoteIf a Playbook's design includes a [UserAction Trigger](/v1/docs/playbooks-the-useraction-trigger) with a connection from an App or Operator back to the Trigger, the Playbook's priority level will automatically be set to High, regardless of the priority level manually set for the Playbook.

## ROI

Enter the number of minutes of analyst time that will be saved with each execution of the Playbook in the **Minutes** box. Enter the hourly rate of the analyst in the **Rate/Hour** box. Every time the Playbook executes, these values will be used to calculate how much time and money were saved by executing the Playbook rather than having the analyst do the work manually. See [*Playbooks: Return on Investment*](/v1/docs/playbooks-return-on-investment) for more information.

## Failure Notifications

The **Failure Notifications**feature allows ThreatConnect users to specify email addresses that should receive an email if a Playbook fails to execute.

NoteIf the **Failure Notifications** feature is not displayed in the **Playbook Settings** menu, contact your System Administrator to enable it.

Select the **Enabled**checkbox (Figure 1) to enable failure notifications. After this checkbox is selected, an **Include Log Files**checkbox and an **Email text**box will be displayed (Figure 4).

![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/settings-image-nagbpmtm.png)

- **Include Log Files**: Select this checkbox to receive log files with failure notifications.
- **Email**: Enter the email address(es) to which failure notifications should be sent. If entering multiple email addresses, separate each email address with a comma.

NoteA maximum of 10 failure notifications will be sent per day. If a Playbook fails more than 10 times, subsequent failure notifications will not be sent.NoteFailure notifications will be sent only for full Playbook failures. If a Playbook partially fails, a failure notification will not be sent.

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*

20110-06 v.02.B