We recently had a playbook action not execute. When we investigated the playbook's configuration, we noticed that it was reporting as "INCOMPLETE". How can we resolve this issue?
Check the email addresses that notifications are being sent to. Remove any email address of users that are not Red Canary users.
The "INCOMPLETE" label may be added to playbooks if one or more validation checks fail. In most cases, it may be due an invalid user being specified in the Send notification... field. The two playbook actions that have this particular validation check are Collect Forensics and Delete and Capture File.