Troubleshooting Playbooks
Helps automation engineers and security analysts identify and resolve issues with playbooks and tasks, focusing on error analysis, execution failures, and runtime metrics
Common Dashboards ENABLED
Details
| ID | b335f061d2f44edebfbdaa2ba538e0c5 |
|---|---|
| From Version | 6.10.0 |
Widgets (7)
Playbook run errors
Custom XQL pie
dataset = playbook_runs | filter playbook_status = "failed" | comp count() as error_count by playbook_name | sort desc error_count | view graph type = pie xaxis = playbook_name yaxis = error_count
Task execution errors
Custom XQL pie
dataset = playbook_tasks | filter task_status = "Error" | comp count() as error_count by task_name | sort desc error_count | view graph type = pie xaxis = task_name yaxis = error_count
Failed automation tasks
Custom XQL single
dataset = playbook_tasks | filter task_status = "Error" and automated = true | comp count() as error_count | view graph type = single subtype = standard yaxis = error_count
Failed manual tasks
Custom XQL single
dataset = playbook_tasks | filter task_status = "Error" and automated = false | comp count() as error_count | view graph type = single subtype = standard yaxis = error_count
Top 5 playbooks average runtime
Custom XQL column
dataset = playbook_runs | filter playbook_status in ("completed", "failed") | comp avg(run_time) as avg_run_time_secs by playbook_name | sort desc avg_run_time_secs | limit 5 | view graph type = column subtype = grouped xaxis = playbook_name yaxis = avg_run_time_secs
Executions by status per manual tasks
Custom XQL column
dataset = playbook_tasks | filter automated = false | comp count() as exec_count by task_name, task_status | sort desc exec_count | view graph type = column subtype = grouped xaxis = task_name yaxis = exec_count series = task_status
Automated task errors
Custom XQL column
dataset = playbook_tasks | filter automated = true | comp count() as error_count by task_name | sort desc error_count | view graph type = column xaxis = task_name yaxis = error_count
{ "dashboards_data": [ { "id": "b335f061d2f44edebfbdaa2ba538e0c5", "name": "Troubleshooting Playbooks", "description": "Helps automation engineers and security analysts identify and resolve issues with playbooks and tasks, focusing on error analysis, execution failures, and runtime metrics", "status": "ENABLED", "layout": [ { "id": "row-5466", "data": [ { "key": "xql", "data": { "type": "Custom XQL", "title": "Playbook run errors", "width": 25, "height": 547, "phrase": "dataset = playbook_runs\n| filter playbook_status = \"failed\"\n| comp count() as error_count by playbook_name\n| sort desc error_count\n| view graph type = pie xaxis = playbook_name yaxis = error_count ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "playbook_name" } }, { "command": { "op": "=", "name": "yaxis", "value": "error_count" } } ] } } }, { "key": "xql", "data": { "type": "Custom XQL", "title": "Task execution errors", "width": 25, "height": 547, "phrase": "dataset = playbook_tasks\n| filter task_status = \"Error\"\n| comp count() as error_count by task_name\n| sort desc error_count\n| view graph type = pie xaxis = task_name yaxis = error_count ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "task_name" } }, { "command": { "op": "=", "name": "yaxis", "value": "error_count" } } ] } } }, { "key": "xql", "data": { "type": "Custom XQL", "title": "Failed automation tasks", "width": 25, "height": 547, "phrase": "dataset = playbook_tasks\n| filter task_status = \"Error\" and automated = true\n| comp count() as error_count\n| view graph type = single subtype = standard yaxis = error_count ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "error_count" } } ] } } }, { "key": "xql", "data": { "type": "Custom XQL", "title": "Failed manual tasks", "width": 25, "height": 547, "phrase": "dataset = playbook_tasks\n| filter task_status = \"Error\" and automated = false\n| comp count() as error_count\n| view graph type = single subtype = standard yaxis = error_count", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "single", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "standard" } }, { "command": { "op": "=", "name": "yaxis", "value": "error_count" } } ] } } } ] }, { "id": "row-2582", "data": [ { "key": "xql", "data": { "type": "Custom XQL", "title": "Top 5 playbooks average runtime", "width": 33.333333333333336, "height": 547, "phrase": "dataset = playbook_runs\n| filter playbook_status in (\"completed\", \"failed\")\n| comp avg(run_time) as avg_run_time_secs by playbook_name\n| sort desc avg_run_time_secs \n| limit 5\n| view graph type = column subtype = grouped xaxis = playbook_name yaxis = avg_run_time_secs ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "grouped" } }, { "command": { "op": "=", "name": "xaxis", "value": "playbook_name" } }, { "command": { "op": "=", "name": "yaxis", "value": "avg_run_time_secs" } } ] } } }, { "key": "xql", "data": { "type": "Custom XQL", "title": "Executions by status per manual tasks", "width": 33.333333333333336, "height": 547, "phrase": "dataset = playbook_tasks\n| filter automated = false\n| comp count() as exec_count by task_name, task_status\n| sort desc exec_count\n| view graph type = column subtype = grouped xaxis = task_name yaxis = exec_count series = task_status ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "grouped" } }, { "command": { "op": "=", "name": "xaxis", "value": "task_name" } }, { "command": { "op": "=", "name": "yaxis", "value": "exec_count" } }, { "command": { "op": "=", "name": "series", "value": "task_status" } } ] } } }, { "key": "xql", "data": { "type": "Custom XQL", "title": "Automated task errors", "width": 33.333333333333336, "height": 547, "phrase": "dataset = playbook_tasks\n| filter automated = true\n| comp count() as error_count by task_name\n| sort desc error_count\n| view graph type = column xaxis = task_name yaxis = error_count ", "time_frame": { "relativeTime": 604800000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "task_name" } }, { "command": { "op": "=", "name": "yaxis", "value": "error_count" } } ] } } } ] } ], "default_dashboard_id": 1, "global_id": "b335f061d2f44edebfbdaa2ba538e0c5", "metadata": { "params": [] } } ], "widgets_data": [], "fromVersion": "6.10.0" }