Has anyone utilized the Re-Attach Playbook under Tools before and can explain how it works?

[Joseph3]

Dear Community,

Please, has anyone utilized the Re-Attach Playbook under Tools before and can explain how it works?
I noticed at my end that trying to execute the action within the same playbook you want to re-attach doesn't seem possible and that's what would have made sense logically.

[Dmitry_Sarakeev]

hi, can you elaborate on this? there is an option to add manually playbook to run on alert, are you referring to this or something else?

[Joseph3]

Hi Dmitry, not that action, under the Power-ups tab, we have the Tools actions and that contains the Re-Attach Playbook action

[Dmitry_Sarakeev]

i see, thanks for the info, im not familiar with it, will try to check as well

[Joseph3]

Alright, please get back to me if you have any update. Thanks

[Dmitry_Sarakeev]

wow i missed this one im sorry, checking it now
i can see that the action goes to the DB and try to remove any "links" between alert and playbook, and attach playbook again

[Dmitry_Sarakeev]

let me also ask internally about this action

[Dmitry_Sarakeev]

hey, to follow up on this, i got info that that action only supports on prem instances of Chronicle SOAR. It's not for SaaS.
in its current form its going to be deprecated.
The alternative could be the option to rerun playbook available on the playbook screen in Chronicle UI

[Joseph3]

Alright @Dmitry_Sarakeev , thanks

[Joseph3]

Hi @Dmitry_Sarakeev , just thinking of it now, since the option to rerun a playbook is available through the UI, why cant we have this as an action that can be called from within the playbook itself provided certain conditions are met

[Dmitry_Sarakeev]

afaik the team plans to do something with the action, but as similar is available in ui, the change took less priority

[Joseph3]

Alright, just that there are some use-cases we have that the action will be useful for.