SOAR - playbook automation not running on new ingestions

Applicability

Description

The CrowdStrike App asset is configured with scheduled ingestion polling. It created new containers/events. The playbook automation was not kicking off, despite being active with the correct label configured.

Investigation

When manually running the playbook in an event, the playbook failed with error "The playbook has not passed validation".

Open the playbook in Playbook Editor, it shows that the playbook needs to be validated with current Python version 3.13. It depends on the SOAR version being installed, the playbook validation can run automatically.

Resolution

The following steps resolved the issue:

1. Opened playbook in Playbook Editor, the playbook has not passed python validation. The editor automatically detected it and validated the playbook.
2. Toggling off Active in the playbook Settings, saving the playbook after it passed validation.
3. The playbook was saved successfully. Re-enabling automation run by toggling on Active.
4. After around 15 minutes for the system re-syncing with the change, the playbook run was being triggered automatically for new CrowdStrike ingestions.