Approving playbooks or response actions

All playbooks in the Training operation mode require a user's approval. You can also configure manual approval of response actions launched within the playbook.

To approve or reject a playbook launch, you must have one of the following roles: Main administrator, Junior analyst, Tier 1 analyst, Tier 2 analyst, Tenant administrator.

To approve or reject a response action launch, you must have one of the following roles: Main administrator, Approver, Tenant administrator.

If there are playbooks or response actions that are awaiting a user's approval, a notification appears at the top of the Open Single Management Platform Console. Additionally, if the user's approval is required for the response action launch, an email notification is sent to the email address within the time period specified in the algorithm of the playbook.

To view the list of playbooks and response actions that are awaiting approval, do one of the following:

• Click the View approval requests link at the top of the Open Single Management Platform Console.
• Follow the link in the notification that is sent to your email address.

The Approval requests pane with the table that contains the full list of approval requests opens.

The Approval requests table contains the following columns:

• Time. Date and time when a playbook or a response action requested a user's approval.
• Approval due date. Date and time by which the user must approve or reject the playbook or the response action. If the user has not approved the playbook or the response action by this time, the launch is canceled.
• Playbook. Name of a custom or predefined playbook that requests a user's approval.
• Response action. Actions that are launched within playbooks.
• Assets. Number of the assets for which the playbook or response action is launched. You can view the list of assets for which the user's approval is requested by clicking the link with the number of the assets.
• Response parameters. Response action parameters that are specified in the response action or playbook algorithm.
• Alert or incident ID. ID that contains a link to the alert or incident details.

To approve or reject playbooks:

1. In the notification at the top of Open Single Management Platform Console, click the View approval requests link.

   A notification with the View approval requests link is displayed only if there is a playbook that is waiting for a user's approval.

2. In the Approval requests pane that opens, select one or more playbooks, and then do one of the following:
   • To approve the launching of a playbook, click the Approve button.

     After that, the playbook is launched. The action status in the Response history sections changes to In progress.

   • To decline the launching of a playbook, click the Reject button.

     After that, the launching of the playbook is canceled. The action status in the Response history sections changes to Rejected.

3. Click the Close button () to close the Approval requests pane.

After approving or rejecting playbooks, you can view their statuses in the Response history section.

To approve or reject response actions:

1. In the notification at the top of Open Single Management Platform Console, click the View approval requests link.

   A notification with the View approval requests link is displayed only if there is a response action that is waiting for a user's approval.

   The Approval requests pane opens.

2. In the Approval requests pane that opens, in the Assets column, click the link with the number of assets.

   The Assets to approve pane that contains the full list of assets opens.

3. Check the list of assets for which the manual approval is required, and then do one of the following:
   • To approve the launch of a response action for assets, select one or more assets you need, and then click the Approve button. After that, the response action for the selected assets is launched.
   • To decline the launch of a response action for assets, select one or more assets you need, and then click the Reject button. After that, the launch of the response action for the selected assets is canceled.
4. Click the Close button () to close the Assets to approve pane.
5. Click the Close button () to close the Approval requests pane.

After approving or rejecting response actions, you can view their statuses in the Response history section.

Page top