--- title: "The UserAction Trigger | ThreatConnect" slug: "the-useraction-trigger" description: "This article describes how to configure the UserAction Trigger, which lets you run Playbooks on demand while viewing details for Groups, Indicators, Intelligence Requirements, Tracks, and Victims in Requirements, and Victims in ThreatConnect." tags: ["Orchestration and Automation"] updated: 2025-06-26T11:45:54Z published: 2025-06-26T11:45:54Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # The UserAction Trigger ## Overview A Trigger is an event that initiates the actions defined within a Playbook. The UserAction Trigger in ThreatConnect® lets you run Playbooks on demand from the **Details**screen or drawer for threat intelligence data objects (Groups, Indicators, Intelligence Requirements, and Victims). You can also [run UserAction Trigger–based Playbooks for Indicators while using Threat Graph](https://knowledge.threatconnect.com/docs/running-playbooks-in-threat-graph). This Trigger is contextually aware and user driven, and it allows a customized response. NoteIf a Playbook's design includes a UserAction Trigger with a connection from an App or Operator back to the Trigger, the Playbook's [priority level](https://knowledge.threatconnect.com/docs/settings#priority) will be set to **High**automatically, regardless of the priority level set manually for the Playbook.NoteYou cannot execute UserAction Trigger–based Playbooks on the **Details**drawer for Email and Task Groups or Victims. ## Before You Start ### User Roles - To view a Playbook with a UserAction Trigger, your user account can have any [Organization role](https://knowledge.threatconnect.com/docs/organization-roles). - To add the UserAction Trigger to a Playbook, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer. - To execute UserAction Trigger–based Playbooks for threat intelligence data objects, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer. ### Prerequisites - To have access to Playbooks on your ThreatConnect instance, turn on the **playbooksEnabled** system setting (must be a System Administrator to perform this action). - To have access to Playbooks in your Organization, turn on the **Enable Playbooks** permission on the **Permissions** tab of the **Organization Information** window when editing your Organization on the **Organizations** tab of the **Account Settings** screen (must be a System Administrator, Operations Administrator, or Accounts Administrator to perform this action). ## Adding a UserAction Trigger to a Playbook Follow these steps to add a UserAction Trigger to a Playbook and configure the Trigger: 1. Click **Playbooks** on the top navigation bar in ThreatConnect to open the [**Playbooks** screen](https://knowledge.threatconnect.com/docs/the-playbooks-screen). 2. [Create a new Playbook](https://knowledge.threatconnect.com/docs/the-playbooks-screen#creating-playbooks)[](/docs/playbooks) or open an existing one. 3. Click![Playbook Designer Triggers icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Designer%20Triggers%20icon.png)**Triggers** on the side navigation bar of the [Playbook Designer](/docs/the-playbook-designer) and select **UserAction** in the **External** menu to add a UserAction Trigger to the design pane (Figure 1). ![Figure 1_The UserAction Trigger_7.0.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_The%20UserAction%20Trigger_7.7.1.png) 4. Double-click the UserAction Trigger to edit it. 5. Fill out the fields on Step 1 (**Configure)** of the **Edit Trigger**drawer (Figure 2) as follows:HintClick **Display Documentation**![Playbooks_Display Documentation icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbooks_Display%20Documentation%20icon.png)at the upper-right corner of the **Edit Trigger** pane to view information about the Trigger, including a description of the Trigger, its input parameters, and its output variables.![Graphical user interface, text, application, Teams Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_The%20UserAction%20Trigger_7.7.1.png) - **User Action Name**: Enter a name for the Trigger. This name will represent the Playbook on the **Playbooks**card (**Details**screen and drawer) and **Playbook Actions**card (legacy **Details**screen) and in the **Select Playbook** window (Threat Graph) for the object types selected in the **Type**dropdown.HintIt may be helpful to give the Trigger the same name as the Playbook so that it is clear which Playbook the Trigger belongs to. - **Type**: Select the object types for which the Playbook will be available.NoteAlthough the **Type**dropdown includes a **Case**option, the UserAction Trigger is not supported for [Workflow Cases](https://knowledge.threatconnect.com/docs/workflow-cases). - **Timeout**: Enter the amount of time, in minutes, that the Playbook will be allowed to run before timing out. The minimum value is 5 minutes. - **Run as current user**: (Optional) Select this checkbox to execute the Playbook under the user account that initiates the Playbook's execution rather than the user selected in the **Run As** dropdown list of the [**Settings**](/docs/settings)**![Playbook Settings menu](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Settings%20menu.png)**menu at the upper-right corner of the Playbook Designer. - Click **NEXT.**NoteIf you select the **Run as current user** checkbox, the **Run As** dropdown on the **Settings**![Playbook Settings menu](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Settings%20menu.png)menu at the upper-right corner of the Playbook Designer will be grayed out and display the text “Overridden by UserAction.” 6. ****Fill out the fields on Step 2 **(Response Body)**on the **Edit Trigger** drawer (Figure 3) as follows: ![The Edit Trigger window of an UserAction trigger](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_The%20UserActionTrigger_7.9.2.png) Now you can continue to [build](https://knowledge.threatconnect.com/docs/designing-a-playbook) and [activate](https://knowledge.threatconnect.com/docs/activating-a-playbook)the Playbook which will make it available for execution. When building the Playbook, you can interact with the following features of the UserAction Trigger to view more information about and manage the Trigger: - **Body**: (Optional) Enter the message to display to the user after the Playbook's execution is complete. HintYou can use variables in the Respon**se****Body**. - Click **SAVE** to save the Trigger’s configuration. - Hover over the **Hashtag**![Playbook Trigger Hashtag icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Trigger%20Hashtag%20icon.png)icon at the upper-left corner of the Trigger to view a scrollable list of output variables, which are values that the Trigger can send to other [Apps and Operators](https://knowledge.threatconnect.com/docs/parts-of-a-playbook) in the Playbook. - Hover over the **Information**![Playbook Trigger Information icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Trigger%20Information%20icon.png)at the upper-left corner of the Trigger to view the object types the Playbook is available for, the Trigger’s timeout length, and whether the Playbook is configured to run under the user account that initiated the Playbook’s execution (**true**) rather than the [**Run As**](https://knowledge.threatconnect.com/docs/settings#run-as) user (**false**). - Click the **Menu**![Playbook Trigger Menu icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Trigger%20Menu%20icon.png)at the upper-right corner of the Trigger to view a menu with options to edit, disable, clone, and delete the Trigger.HintEnsure the Playbook has an informative description, as its description will accompany the Trigger’s name on the **Playbooks** card (**Details** screen and drawer) and in the **Select Playbook**window (Threat Graph). You can edit a Playbook’s description in the **Summary**![Playbook Designer - Summary icon(1)](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Designer%20-%20Summary%20icon(1).png)drawer in the Playbook Designer.WarningAssociating a midstream App to the Trigger to generate a faster response (i.e., before the Playbook workflow is complete) is not supported. ## Execute a Playbook With a UserAction Trigger #### Details Screen and Drawer The **Playbooks** card on an object's **Details** screen and drawer displays all active Playbooks with a UserAction Trigger configured for the object's type (Figure 4): ![Figure 4_The UserActionTrigger_7.9.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_The%20UserActionTrigger_7.9.2.png) Click **Run playbook**![Run playbook icon_Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Run%20playbook%20icon_Details%20screen.png)in a Playbook’s row to execute the Playbook. If the Playbook executes successfully, the Playbook’s status will update to **Completed**, and a![UserAction Trigger Tooltip icon(1)](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/UserAction%20Trigger%20Tooltip%20icon(1).png)icon displaying the Trigger’s response body in a tooltip will be added in the Playbook’s row (Figure 5). Note:If no response body was entered in the Trigger's configuration, the![UserAction Trigger Tooltip icon(1)](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/UserAction%20Trigger%20Tooltip%20icon(1).png)icon will still be present, but nothing will happen if you click or hover over it.(i.e no tooltip will be displayed). ![Figure 5_The UserActionTrigger_7.9.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_The%20UserActionTrigger_7.9.2.png) ## Legacy Details Screen The **Playbook Actions** card on an object's legacy **Details** screen displays all active Playbooks with a UserAction Trigger configured for the object's type (Figure 6). ![Figure 6_The UserActionTrigger_7.9.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_The%20UserActionTrigger_7.9.2.png) Click **Click to run this playbook ![Run icon_Legacy Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Run%20icon_Legacy%20Details%20screen.png)** in a Playbook’s row to execute the Playbook. If the Playbook executes successfully, the Playbook’s status will update to **Completed**, and a tooltip displaying the Trigger’s response body will be added in the Playbook’s row (Figure 7). If the Playbook’s execution fails, the Playbook’s status will update to **Error – 500**. ![Figure 7_The UserActionTrigger_7.9.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%207_The%20UserActionTrigger_7.9.2.png) NoteThere is no icon associated with the response-body tooltip on the legacy **Details** screen. If you closed the tooltip and want to reopen it, click on or hover the Playbook’s status.NoteIf no response body was entered in the Trigger’s configuration, the tooltip will be empty. ## Threat Graph [Playbooks with a UserAction Trigger configured for Indicator types can be executed in Threat Graph from an Indicator’s node menu and from the Threat Graph Objects drawer.](https://knowledge.threatconnect.com/docs/running-playbooks-in-threat-graph) --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc. VirusTotal™ is a trademark of Google, Inc.* 20055-01 v.09.C ## Related - [Executing a Playbook](/executing-a-playbook.md) - [Parts of a Playbook](/parts-of-a-playbook.md) - [The Playbook Designer](/the-playbook-designer.md)