Playbooks showing cancelled with the record is closed

[mpmacconnell]

I am working on converting over our Flows so they can be used in Playbooks under the Security Operations Workspace. The playbooks are calling the Flows properly and all the tasks are shown. It goes all the way to end and the playbook will show completed. The associated SIR record gets changed to Closed Complete in the Flow. After a few minutes, the Playbooks are showing:

playbook is cancelled as the associated security incident is closed

Anyone have any ideas?

[Mohammed Kemal]

Hey @mpmacconnell ,

 My understanding from your description is that as the associated SIR record gets changed to Closed Complete in the Flow, the Playbooks is cancelled (by the system) as the associated security incident is closed. This is a normal and expected. Any active workflow(s), playbook activities, and flows will be automatically cancelled up on the closure of the security incident. If you have any activities you need to happen it should come before this action taken place. Let me know if you have any other questions or you would like to add any related questions.

Regards,

Mo Kemal.

[Martin Dewit]

I was seeing this same issue, and it appears to have been fixed in Version 1.7.0 - February 2025 release. "After a SIR is closed, the associated playbooks are displayed as 'Cancelled' with the reason: "Cancelled by system," even though the playbook was completed before the closure."