Use predefined widgets in playbook views

Supported in:

Predefined widgets are ready-made widgets linked to actions in integrations from the Content Hub (Marketplace for SOAR only users). Created by Google SecOps experts, these widgets provide specific information for actions, saving time on customizing and building a playbook view.

After you download the integration, the actions appear as usual when creating a playbook, with special icons that indicate predefined widgets. 

You can use these widgets in existing playbooks or when creating new ones.

Build a new playbook view with predefined widgets

  1. Go to Google SecOps Content Hub > Response Integrations and select VirusTotal.
  2. Click Read More. Some of the VirusTotal actions come with predefined widgets:
  3. Download and configure the VirusTotal integration as required.
  4. Go to Response > Playbooks and explore how to use an action with a predefined widget.
  5. Create a new playbook, open the Step Selector and drag the VirusTotal Enrich hash action.
  6. Click Add View and enter a name (contains VirusTotal widgets) and choose a role. In this example, leave the checkbox selected to include predefined widgets. You can choose to opt out or remove them later after creating the view.
  7. After you create the view, the widget is automatically added to the view. You can only edit these options in this widget: Name, Description, Conditions.
  8. After the playbook is attached to an alert, it appears on the Playbook tab of the case alert view.

Add predefined widgets to an existing playbook

  1. Locate the required playbook and open the Step Selection.
  2. Drag the VirusTotal Enrich URL action into the playbook, and click Save.
  3. Open the view, where the predefined widget appears in the Predefined column.
  4. Drag it into the view. 


Need more help? Get answers from Community members and Google SecOps professionals.