Execution logs

S4E records detailed logs for every playbook execution, providing full visibility into each step's outcome, timing, and data flow. Execution logs are essential for troubleshooting, compliance, and continuous improvement of your workflows.

Accessing Execution Logs

Global Log View

Navigate to Playbooks > Execution Logs to see all playbook executions across your organization.

Per-Playbook Logs

  1. Navigate to Playbooks and open a specific playbook.
  2. Click the Executions tab to see all runs of that playbook.

Per-Finding Logs

  1. Open a finding detail page.
  2. Scroll to the Playbook Activity section to see playbooks that have run for this finding.

Log Entry Overview

Each execution log entry displays:

Field Description
Execution ID Unique identifier for the run.
Playbook Name Name of the playbook that was executed.
Trigger How the execution was initiated (Manual, Finding, Schedule, Webhook).
Started By The user or automation rule that triggered the run.
Start Time When the execution began.
End Time When the execution completed (or was cancelled).
Duration Total execution time.
Status Final outcome (Completed, Failed, Cancelled, In Progress).
Steps Summary of step outcomes (e.g., 5/6 completed, 1 failed).

Execution Detail View

Click on any execution to open the detailed view.

Step-by-Step Timeline

The timeline shows each step with:

  • Step name and type (Action, Condition, Approval, Delay, Parallel).
  • Status -- Completed, Failed, Skipped, Waiting.
  • Start and end time for each step.
  • Duration of each step.
  • Input and output data -- What data was passed into and produced by the step.

Step Output Details

For each completed step, view:

  • Action results -- API responses, script output, notification delivery status.
  • Condition evaluation -- Which branch was taken and why.
  • Approval decision -- Who approved or rejected, and their notes.
  • Error information -- For failed steps, the error message, code, and diagnostic data.

Data Flow View

The data flow view shows how variables are passed between steps:

  • Input variables provided at the start.
  • Variables produced by each step.
  • How downstream steps consumed upstream variables.

Tip

The data flow view is invaluable for debugging playbooks where a step fails due to unexpected input from a previous step.

Filtering Execution Logs

Filter the log list by:

  • Date range -- Execution start date.
  • Playbook -- Specific playbook name.
  • Status -- Completed, Failed, Cancelled, In Progress.
  • Trigger type -- Manual, Finding, Schedule, Webhook.
  • User -- Who triggered the execution.
  • Finding -- Associated finding.
  • Asset -- Target asset.

Searching Logs

Search across execution logs by:

  • Execution ID.
  • Playbook name.
  • Step output content.
  • Error messages.

Comparing Executions

Compare two executions of the same playbook to identify differences:

  1. Select two executions from the log list.
  2. Click Compare.
  3. The comparison view highlights:
    • Steps that succeeded in one run but failed in another.
    • Differences in step durations.
    • Differences in input variables.
    • Different condition branches taken.

Exporting Execution Logs

Export logs for compliance or external analysis:

  1. Apply desired filters.
  2. Click Export.
  3. Choose the format:
    • CSV -- Summary data for spreadsheets.
    • JSON -- Full detail including step data for programmatic analysis.
    • PDF -- Formatted report for compliance documentation.

Note

Execution log retention follows your organization's data retention policy. Enterprise plans support configurable retention periods.

Re-Running a Playbook

From an execution log entry, you can re-run the playbook with the same or modified inputs:

  1. Open the execution detail view.
  2. Click Re-Run.
  3. Review the input variables (modify if needed).
  4. Click Start Playbook.

What's Next?