Playbook added to an automation rule does not persist.

Applicability

Description

Splunk Enterprise Security automation rules allow selecting and saving an ES playbook, but after saving the playbook is no longer associated to the automation rule and does not run, impacting the ability to rely on these automations.

Investigation

1.In the HAR file, the automation_rule request response shows no playbooks are attached to the rule. 

"playbooks": []

2. mc_soar_api_handler.log has this error : 

message: SOAR req error: [GET] /rest/playbook, params={'page_size': '1?output_mode=json'}, status=400, content={"failed": true, "message": "502 Server Error: Bad Gateway for url: https://[ES]:8089/servicesNS/-/missioncontrol/v1/internal/authorization/user/[username]?output_mode=json&count=30&offset=0"

3. Also many  Authentication failed: Invalid JWT errors. are present.

Resolution

All of the errors turned out to be red herrings. The  playbook name had a "/" character - this slash is incorrectly parsed as part of the path, and because of that, v1/soar API handler cannot find the right endpoint handler. 

Resolution:
Rename the playbook name and remove  the "/" character.
The playbook will get added successfully to the automation rule.