Configure action retries in playbooks

This document explains how automated actions in playbooks can sometimes fail due to temporary problems like network outages or API rate limits. To make sure your playbooks are more resilient, you can configure individual actions to automatically retry if they encounter such failures.

Configure action retries

Action retries help your playbooks recover from temporary failures like network issues, API rate limits, or service unavailability. These retries apply to standard playbook actions, such as enrichment, containment, or notifications.

However, retries are not attempted for actions that time out. They also don't apply to flow control actions (like conditions or playbook blocks), as these aren't designed to fail in the same way.

To configure retries for an action:

1. Double-click the relevant action in the playbook designer.
2. In the sidebar that appears, click the Settings tab, and then click the Retry on failure toggle to turn it on.
3. Specify the following parameters:
   • Number of retries: Enter how many times the action should attempt to rerun if it fails.
   • Delay between retries: Define the delay in seconds, minutes, or hours between each retry attempt.
4. In the If step fails section, select one of the following options if the action ultimately fails after all retry attempts:
   • Stop playbook: The playbook execution stops.
   • Skip step: The playbook continues to the next step.
5. Click Save .

How retries appear during playbook execution

When a playbook step with retries runs, you'll see specific statuses and messages indicating the progress of retry attempts:

• If an action fails with retries configured, its status in the Playbooks tab temporarily changes to Waiting for next retry before the next attempt.
• If the action succeeds after one or more retries, its final status in the Playbooks tab indicates success, along with the number of retries (for example, Completed after 2 retries ).
• If the action fails after all retry attempts, its final status indicates failure, along with the number of retries (for example, Failed after 3 retries ).
• Relevant information about retry attempts also appears on the Case Wall .

Need more help? Get answers from Community members and Google SecOps professionals.