Rerun playbooks

Supported in:
Google secops SOAR

This document describes how to rerun a playbook associated with a case alert. This feature allows for up to 9 reruns (10 total runs, including the initial execution) per alert.

This feature can be useful in the following situations:

  • Data freshness: Obtain more up-to-date results after the initial run.
  • Error recovery: Rerun the entire playbook following one or more failed steps.
  • Logic updates: Run the playbook with new logic after making changes on the Playbooks page.

To rerun a playbook, follow these steps:

  1. On the Cases page, go to the Playbooks tab of the selected alert.
  2. Locate the playbook you want to rerun.
  3. Click replay Rerun Playbook.

Each time you rerun the playbook, the system updates the iteration number and writes informative messages to the case wall.

Need more help? Get answers from Community members and Google SecOps professionals.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025年10月24日 UTC.