We're on Quebec, and I followed this article to integrate SIR playbooks with Workspace: https://docs.servicenow.com/bundle/quebec-servicenow-platform/page/administer/workspace/task/integrate-playbook-workspace.html
I've activated this out of box flow in Flow Designer: Security Incident - Automated Phishing Playbook - Template V1.
It is triggered by any new or updated SIR where category is Phishing and source is Email.
I created an appropriate SIR, and I've verified the flow has initiated:
In the Classic View of an SIR, I can go to "Show All Related Lists" and see the playbook/flow's first SIT was created:
In the New UI (Security Analyst Workspace), I can see that the Playbook is recognized and active on the right sidebar:
But that same SIR in Workspace view shows "There are no playbooks available"
The above screenshots were taken after creating the Contextual Side Panel Action Assignment according to that document linked at the top of this post:
As you can see, I did NOT include this script condition, which is mentioned in the document: sn_playbook.PlaybookExperience.parentRecordContainsPlaybook(current)
If I do add the script condition according to the document, then the "Playbook" option in the side panel disappears completely:
Hmm...tried that, still not working. Here's what I did:
1. On out of box flow "Security Incident - Automated Phishing Playbook - Template V1" successfully added sir_playbook tag, went to Agent Workspace, found a relevant SIR (same one I tested with yesterday), did not see Playbook as a 4th choice in the sidebar at all.
2. Went to my "Playbook" action assignment, removed script condition "sn_playbook.PlaybookExperience.parentRecordContainsPlaybook(current)"
3. Confirmed the SIR in Workspace now showed the "Playbook" option again in the sidebar, but still gave me "There are no playbooks available."
So then I thought, maybe it has to be a custom, self-made playbook, and maybe it has to be a brand new SIR.
4. Created a Flow in Flow Designer called "Playbook - SIR - Crowdstrike Alert Suspicious Activity" that changes state to Eradicate and creates an SIR.
5. Went to sys_hub_flow.list, found my playbook, added sir_playbook tag.
6. In Flow Designer, made sure the new flow/playbook was active.
7. Created a new SIR matching the flow's trigger conditions.
8. SIR immediately went into "Eradicate" state and created the SIT, and the flow execution is running, so I know the flow was triggered.
9. Playbook contextual side panel in Workspace still says "There are no playbooks available" with no option to manually choose any playbook, even the one it's currently running.
This screenshot shows how the field change was performed automatically after I created the SIR and how there are still no playbooks available:
This shows the Tag was successfully added:
Finally, I thought - okay the other playbooks are all in the Security Operations Spoke scope, let me recreate my custom playbook in the SOS spoke, add the tag, activate, create a new SIR.
I did that, making sure my first playbook was disabled. And I got the same thing - even with SOS scope playbook and the sir_playbook tag, it still says "There are no playbooks available"
I made sure that the playbook is "still running" as it is doing a "Wait for completion" on the SIT.
EDIT: I can confirm that the instructions do allow me to manually select playbooks in the Security Analyst Workspace (Security Incidents (New UI)):
Also, I just realized that the documentation you linked specifically refers to Security Analyst Workspace.
In my OP, I link to documentation that says this should be possible in Agent Workspace as well. What am I missing?
