Re-enabling Disabled Plays

[Way2Fast74]

I was experimenting with some plays to work on some tuning of SO and marked one of the plays as disabled, but I'm not seeing any way to re-enable it. Is there a way to do this? It feels like it should be something fairly easy to do, but I can't seem to find any option to do so.

[cm-ops]

In Playbook, navigate to your inactive play, hit the three dots (Action) on the right > Status > Active.

[Way2Fast74]

Does this also work for when a play has gone from Active > Inactive > Disabled? The one I'm trying to re-enable is disabled and when clicking on the three dots (Action) it doesn't give Status as an option like it would an inactive play.

[cm-ops]

Ah, my mistake, saw disabled and was thinking inactive, see below for a disabled play.

A Play can also have the status of Disabled, which means that it is broken in some way and should not be made Active https://docs.securityonion.net/en/2.4/playbook.html You would need to recreate the play and make it Active. Once disabled it cannot be made Active.