Rerun playbooks

Supported in:

This document describes how to rerun a playbook associated with a case alert. This feature allows for up to 9 reruns (10 total runs, including the initial execution) per alert.

This feature can be useful in the following situations:

  • Data freshness: Obtain more up-to-date results after the initial run.
  • Error recovery: Rerun the entire playbook following one or more failed steps.
  • Logic updates: Run the playbook with new logic after making changes on the Playbooks page.

To rerun a playbook, follow these steps:

  1. On the Cases page, go to the Playbooks tab of the selected alert.
  2. Locate the playbook you want to rerun.
  3. Click replay Rerun Playbook.

Each time you rerun the playbook, the system updates the iteration number and writes informative messages to the case wall.

Need more help? Get answers from Community members and Google SecOps professionals.