Automated Remediation Use Case

below is an example playbook let's break down how it's built and follow the flow to the desired outcome desired outcome update an existing case with remediation actions native actions create variables, loop, script, and condition additional playbook tools connectors and component the desired outcome is to create a playbook that filters through the alexa traffic site, searches for specific variables, then based on conditions set, either adds the site to a domain block list or to a decrypt list you already have created a playbook that has a record event trigger turbine initiates this playbook every time a record is updated in the case and incident management application use the create variables native action to add the block exception list and configure to add the sites you want to filter for by adding them as array items for the example, we've entered google and swimlane's urls as string property types and applied the changes for efficiency, the loop action to apply more than one action to each item in the array the following steps show a foreach parallel loop added downstream inside the loop the script and condition native actions are added to filter top traffic sites, then set true/false condition criteria first, configure the loop drag and drop the loop action downstream from your variable and click configure to select a playbook property next, configure the script action using inputs drag and drop the script action into the loop from the action panel, click configure from the scripts tab, add the array and string property types the following steps show the create variables array the foreach domain value inputs the python script sets up the execution paths for what will be the next downstream action condition native action if the criteria used from the playbook property from the script action is true, the true flow executes and adds the domain to a block list if the criteria used from the playbook property from the script action is not true, then the false flow executes and adds the domain to a decrypt list use the using the swimlane python chatbot docid\ lowzh sta55hi muzxryb to assist with writing python add the condition native action after the script this use case uses palo alto connectors use desired connectors, as needed on the true flow, add edit custom url category connector on the false flow, add the edit custom url category connector your loop is complete! now, you have the information but need remediation in the playbook, drag and drop the create variable native action and update record native action downstream after the loop to ensure the case is updated with remediation actions here's a quick look at their configurations tip if you want to combine the final two actions, group them into a component and save in the add panel, the component is now available if you want to publish and access the component in the user content library, see components docid\ ju3wwjc3jojzgs4catext