Playbook action reporting as "INCOMPLETE"

Issue

We recently had a playbook action not execute. When we investigated the playbook's configuration, we noticed that it was reporting as "INCOMPLETE". How can we resolve this issue?

Environment

Red Canary

Resolution

Check the email addresses that notifications are being sent to. Remove any email address of users that are not Red Canary users.

Cause

The "INCOMPLETE" label may be added to playbooks if one or more validation checks fail. In most cases, it may be due an invalid user being specified in the Send notification... field. The two playbook actions that have this particular validation check are Collect Forensics and Delete and Capture File.