Console
    Start free

    Curated dashboard queries: SOAR playbooks

    Supported in:

    This document is for Security Operations Center (SOC) managers and analysts who want to monitor threat landscapes and system health using curated dashboards— predefined dashboards designed for visibility across various security use cases. This document provides a collection of curated dashboards and their underlying queries for the SOAR playbookssource type.

    You can use these queries in the query editor or as a baseline for custom widgets. For information on how to create and manage dashboards, see Manage dashboards .

    Dashboard name Description Chart name Query
    Playbook Dashboard (SOAR)
    		 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 Failed Playbooks Distribution 
     playbook.status = "FAILED"

$Playbook_Name = playbook.display_name

match:
   $Playbook_Name

outcome:
   $Total_Playbook_Runs = count(playbook.name)

order:
   $Total_Playbook_Runs desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Automation Distribution by Environment 
  
     $Automatic = playbook.metadata.automatic
$Environment = playbook.metadata.environments

match:
    $Environment, $Automatic

outcome:
    $Total_Playbook_Runs = count(playbook.name)

order:
    $Total_Playbook_Runs desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Failed Runs 
  
     outcome:
   $Total_Playbook_Runs = count(playbook.name)
   $Playbook_Failed = sum(if(playbook.status = "FAILED", 1, 0))
   $Percentage = math.round(($Playbook_Failed/$Total_Playbook_Runs) *100, 2) 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Failed Playbook Runs per Playbook 
  
     $Playbook_Name = playbook.display_name

match:
    $Playbook_Name

outcome:
    $Total_Playbook_Runs = count(playbook.name)
    $Playbook_Failed = sum(if(playbook.status = "FAILED", 1,0))
    $Percentage = math.round(($Playbook_Failed/$Total_Playbook_Runs) *100, 2)

order:
    $Percentage desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Alerts Closed per Playbook 
  
     $Playbook_Name = playbook.display_name

match:
    $Playbook_Name

outcome:
    $Total_Playbook_Runs = count(playbook.name)
    $Alerts_Closed = sum(if(playbook.status = "COMPLETED" and playbook.action.action = /close/ nocase, 1,0))
    $Percentage = math.round(($Alerts_Closed/$Total_Playbook_Runs) *100, 2)

order:
    $Percentage desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Failed Actions 
  
     $Action_Name =  playbook.action.action

match:
   $Action_Name

outcome:
   $Total_Actions = count(playbook.action.name)
   $Faulted_Action = sum(if(playbook.action.status="FAULTED", 1, 0))
   $Percentage = math.round(($Faulted_Action/$Total_Actions)*100, 2)

order:
   $Percentage desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Failed Playbook Summary 
  
     playbook.status = "FAILED"

$Environment = playbook.metadata.environments
$CaseID = playbook.action.case_metadata.case_id
$Playbook_Name = playbook.display_name
$Playbook_Status = playbook.status
$Action_Name = playbook.action.action
$Action_Status = playbook.action.status
$Action_Status = "FAULTED"
$Action_Message = playbook.action.result_message

match:
    $Environment, $CaseID, $Playbook_Name, $Playbook_Status, $Action_Name, $Action_Status, $Action_Message

outcome:
    $Playbook_Triggered_Time = timestamp.get_timestamp(max(playbook.start_time.seconds), "%F %T")

order:
    $Playbook_Triggered_Time desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Total Playbook Runs 
  
     outcome:
   $Total_Playbook_Runs = count(playbook.name) 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Failed Playbooks Over Time 
  
     playbook.status = "FAILED"

$Playbook_Name = playbook.display_name
$Date = timestamp.get_date(playbook.start_time.seconds)

match:
    $Date, $Playbook_Name

outcome:
    $Total_Playbook_Runs = count(playbook.name)

order:
    $Date asc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Total Failed Playbook Runs 
  
     playbook.status = "FAILED"

outcome:
   $Total_Playbook_Runs = count(playbook.name) 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Average Runtime in Minutes 
  
     outcome:
    $Average = math.round(avg((playbook.end_time.seconds  - playbook.start_time.seconds)/60), 2) 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Alerts Closed by Automation 
  
     playbook.metadata.automatic = true
playbook.action.automatic = true

outcome:
    $Total_Playbook_Runs = count(playbook.name)
    $Alerts_Closed = sum(if(playbook.status = "COMPLETED" and playbook.action.action = /close/ nocase, 1,0))
    $Percentage = math.round(($Alerts_Closed/$Total_Playbook_Runs) *100, 2) 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Failed Actions Distribution 
  
     playbook.action.status = "FAULTED"

$Action_Name = playbook.action.action

match:
    $Action_Name

outcome:
    $Total_Actions = count(playbook.action.name)

order:
    $Total_Actions desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Failed Actions 
  
     outcome:
   $Total_Actions = count(playbook.action.name)
   $Faulted_Actions = sum(if(playbook.action.status = "FAULTED", 1, 0))
   $Percentage = math.round(($Faulted_Actions/$Total_Actions)*100, 2) 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Average Runtime per Playbook 
  
     $Playbook_Name = playbook.display_name

match:
    $Playbook_Name

outcome:
    $Average = math.round(window.avg((playbook.end_time.seconds  - playbook.start_time.seconds)/60), 2)

order:
    $Average desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Alerts Closed by Automation per Environment 
  
     playbook.metadata.automatic = true
playbook.action.automatic = true

$Environment = playbook.metadata.environments

match:
    $Environment

outcome:
    $Total_Alerts = count(playbook.name)
    $Alerts_Closed = sum(if(playbook.status = "COMPLETED" and playbook.action.action = /close/ nocase, 1,0))
    $Percentage = math.round(($Alerts_Closed/$Total_Alerts) *100, 2)

order:
    $Percentage desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Alerts Handled per Playbook by Status 
  
     $Playbook_Name = playbook.display_name
$Playbook_Status = playbook.status

match:
    $Playbook_Name, $Playbook_Status

outcome:
    $Total_Alerts = count(playbook.name)

order:
    $Total_Alerts desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Total Playbooks 
  
     outcome:
   $Playbook_Count = count_distinct(playbook.display_name) 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Playbook Trigger Trend 
  
     playbook.start_time.seconds > 0

$Playbook_Name = playbook.display_name
$Date = timestamp.get_date(playbook.start_time.seconds)

match:
    $Date, $Playbook_Name

outcome:
    $Total_Playbook_Runs = count(playbook.name)

order:
    $Date asc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Playbook Distribution 
  
     $Playbook_Name = playbook.display_name

match:
    $Playbook_Name

outcome:
    $Total_Playbook_Runs = count(playbook.name)

order:
    $Total_Playbook_Runs desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Manual Actions 
  
     outcome:
    $Total_Playbook_Actions = count(playbook.action.automatic)
    $Manual_Action = sum(if(playbook.action.automatic = false, 1,0))
    $Percentage = math.round(($Manual_Action/$Total_Playbook_Actions)*100, 2) 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Total Cases with Failed Playbook Runs 
  
     playbook.status = "FAILED"

outcome:
    $Total_Case_IDs = count_distinct(playbook.action.case_metadata.case_id) 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Top 10 Playbook Actions 
  
     $Playbook_Name = playbook.display_name
$Action_Name = playbook.action.action
$Action_Automatic = playbook.action.automatic
$Action_Status = playbook.action.status
$Action_Message = playbook.action.result_message

match:
    $Playbook_Name, $Action_Name, $Action_Automatic, $Action_Status, $Action_Message

outcome:
    $Total_Playbook_Runs = count(playbook.name)
    $Playbook_Triggered_Time = timestamp.get_timestamp(max(playbook.start_time.seconds), "%F %T")

order:
    $Total_Playbook_Runs desc

limit:
    10 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Playbook Queue 
  
     playbook.status = "PENDING_IN_QUEUE"

$Environment = playbook.metadata.environments
$Playbook_Name = playbook.display_name
$Playbook_Status = playbook.status

match:
   $Playbook_Name, $Playbook_Status, $Environment

outcome:
    $Total_Playbook_Runs = count(playbook.name)

order:
    $Total_Playbook_Runs desc 
 
     

     
    		 

     
 
      
      
Playbook Dashboard (SOAR)
     
    		 
 Provides insights into playbook performance and automation efficiency, including metrics on alerts handled, average run times, and execution errors.
    Note: Apply filters to display relevant results.    		 
 Total Failed Playbooks 
  
     playbook.status = "FAILED"

outcome:
    $Total_Failed_Playbooks = count_distinct(playbook.display_name) 
 
     

     
    		 

     
     

     
     

     
 
     Need more help? 
 Get answers from Community members and Google SecOps professionals. 

     

     
  
 
     

     
  
 
      
  

     
     

     
   
 
   
 

     

     

     
  

     

     
 
      

     
 
      
      Create 
a Mobile Website 

     
     
 
     View Site in Mobile 
 | 
 Classic 

     

     

     

     

     

     

     

     

     

    





















    



    

    
	
     
     
     
 	
      Share by: