"No playbook found Please contact your administrator" error while accessing playbook from Security Incident New UI

Gazal Varshney2
Tera Contributor

Hi,

I have enabled the OOB plugins for SIR and SIR UI and need to access playbooks from security incident New UI. While clicking on playbook icon I am getting the message "No playbook found , Please contact your administrator". all the runbooks are in active state and I am having ghe required role to access playbooks as well. Looking for solutions to resolve this issue. 

Thanks,

Gazal Varshney

1 ACCEPTED SOLUTION

Hi,


One more thing the task are visible in this section based on workflow i.e. playbook attached to this incident. The workflow name  for phishing is Security Incident - Phishing - Template.

 

And then you need to create a document which will have condition attached to it. It is called as Manual runbook. It is OOB.

 

Thanks,
Ashutosh

 

 

View solution in original post

9 REPLIES 9

HI,

I did some investigation and found that you have to create task for your playbooks as per your need. 

https://docs.servicenow.com/bundle/london-security-management/page/product/security-incident-respons...
Thanks,
Ashutosh

Hi,


One more thing the task are visible in this section based on workflow i.e. playbook attached to this incident. The workflow name  for phishing is Security Incident - Phishing - Template.

 

And then you need to create a document which will have condition attached to it. It is called as Manual runbook. It is OOB.

 

Thanks,
Ashutosh

 

 

Chris McDevitt
ServiceNow Employee
ServiceNow Employee

Gazal,

Please see that the document I created for this (see attachment).

Use this mental model:

A Playbook is the union of a KB Article and a Security Incident Response Task (SIT). So, a SIT needs to be created that matches the Runbook Condition before you will see anything.  SIT can be created manually, but typically to ensure a matching, a SIT will be created by a Flow or Workflow.

 

Go ahead and mark this as helpful or correct! 

Gazal Varshney2
Tera Contributor

Hi All,

Thanks for the solutions, I cam across that workflow triggers for phishing template workflow was inactive so I was not able to see any OOB response tasks. On enabling the workflow trigger I was able to get the playbook and it's tasks.

Thanks,

Gazal Varshney

Pooja P
Tera Contributor

Hi @Ashutosh Munot1 or @Gazal Varshney2 

I am new to this topic and we have a requirement to use these templates , i am trying for one SIR record added category as Policy violation and checking if Response task is created or not but its not there in related list .

I have referred doc -https://www.servicenow.com/docs/bundle/yokohama-security-management/page/product/security-incident-r...

Anything i have missed here to add these templated to trigger workflow for the category of SIR . Kindly suggest

 

Thanks,

Pooja