Multiple playbooks cannot be opened simultaneously

[ORBR]

Hi.

I have a collection of playbooks that I want to initiate whenever a new case is opened.

One playbook utilizes an "all" trigger, meaning it's linked to all new cases.

Additionally, another playbook is created based on the tag name.

All tags have been configured, and during testing, everything appears to be functioning correctly.

However, upon the arrival of a new case, only the "All" playbook is attached, and not the playbook associated with the tag. Could there be a limitation where only one playbook can be attached?

[f3rz · Accepted solution]

@ORBR, could you please clarify if all these playbooks have the same priority?
If the answer is positive, please try to change the priorities of that playbook so that they all differ.

Priority - This determines the attachment order of playbooks for the alert. Only one playbook can be attached automatically and it works according to priority order.

https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/whats-on-the-playbooks-s...

[malzahnOptiv]

@f3rz do you know where I can find the release notes where this functionality of the playbook priority (and only one attaching automatically) went into GA?

I'm certain I worked with Chronicle/Siemplify environments in the past which were architected based on sometimes 2 or 3 playbooks triggering simultaneously, with the priority value making little or no difference. Thanks for any further insight you can provide.

[f3rz]

@malzahnOptiv I might be wrong, but as far as I know it is a legacy part of the Product, meaning it was always there. 

[Dmitry_Sarakeev]

+1, i the playbook priority feature was for years in SOAR!

[malzahnOptiv]

Thanks for the reply. Therefore, are we saying that for years only one playbook could be attached automatically? (with the priority controlling which)

[f3rz]

Not exactly, your playbooks can have 3 levels of priority, each level can be attached once. This means you can have 3 automatically attached playbooks in total per single alert (not per the whole case, where you could have more alerts grouped) 

But you also could have a playbook with the action Attach Playbook inside that will increase this amount, and it will ignore priority value.