"No playbook found Please contact your administrator" error while accessing playbook from Security Incident New UI

[Gazal Varshney2]

Hi,

I have enabled the OOB plugins for SIR and SIR UI and need to access playbooks from security incident New UI. While clicking on playbook icon I am getting the message "No playbook found , Please contact your administrator". all the runbooks are in active state and I am having ghe required role to access playbooks as well. Looking for solutions to resolve this issue. 

Thanks,

Gazal Varshney

[Ashutosh Munot1]

HI,

I did some investigation and found that you have to create task for your playbooks as per your need. 

https://docs.servicenow.com/bundle/london-security-management/page/product/security-incident-respons...
Thanks,
Ashutosh

[Ashutosh Munot1 · Accepted solution]

Hi,

One more thing the task are visible in this section based on workflow i.e. playbook attached to this incident. The workflow name  for phishing is Security Incident - Phishing - Template.

And then you need to create a document which will have condition attached to it. It is called as Manual runbook. It is OOB.

Thanks,
Ashutosh

[Chris McDevitt]

Gazal,

Please see that the document I created for this (see attachment).

Use this mental model:

A Playbook is the union of a KB Article and a Security Incident Response Task (SIT). So, a SIT needs to be created that matches the Runbook Condition before you will see anything.  SIT can be created manually, but typically to ensure a matching, a SIT will be created by a Flow or Workflow.

Go ahead and mark this as helpful or correct! 

[Gazal Varshney2]

Hi All,

Thanks for the solutions, I cam across that workflow triggers for phishing template workflow was inactive so I was not able to see any OOB response tasks. On enabling the workflow trigger I was able to get the playbook and it's tasks.

Thanks,

Gazal Varshney

[Pooja P]

Hi @Ashutosh Munot1 or @Gazal Varshney2 

I am new to this topic and we have a requirement to use these templates , i am trying for one SIR record added category as Policy violation and checking if Response task is created or not but its not there in related list .

I have referred doc -https://www.servicenow.com/docs/bundle/yokohama-security-management/page/product/security-incident-r...

Anything i have missed here to add these templated to trigger workflow for the category of SIR . Kindly suggest

Thanks,

Pooja