The list
Playbooks › Runs lists runs across your scope with the alert, the playbook, the verdict and the recommendation. Search by alert, host, action or evidence, and filter to automatic runs, manual runs or failures.
A run
Opening a run shows its trace: each step in order and what it produced, the evidence the verdict read, the queries the investigation agent ran, and the full advisory verdict. Actions show whether they were proposed or executed, and the result reported by the agent or integration.
Retention
Run traces are kept for 90 days. Executed actions stay in the audit log for its own retention. See Retention.