What's on the Playbooks page?

Supported in:

Google SecOps SOAR

A playbook is built on triggers, actions, and flows. Once it is triggered, the playbook moves along the actions to a final resolution. The flow of control executes from left to right, beginning with a defined trigger (yellow box) as the first component, which is mandatory. It then moves to the second component that can be a set of defined actions the playbook must perform (blue box). The last component involves determining the flow of the playbook with an if-then-else condition (purple box). 

To open the Playbooks page, navigate to Response > Playbooks. The Playbooks page displays.

The following actions are available:

• Plus : Add a new playbook or block. Here you can choose which folder and which environment the playbook or block belongs to.
• Edit : Lets you select single or multiple playbooks and blocks for use with the Actions menu. To edit the folder name, you need to click the edit icon, and put your mouse on the name, click and then type new name. After you click the edit icon, you can delete playbooks.
• Filter : Clicking on the filter icon opens a dialog where you can choose to filter the display based on:
  • Playbook simulator is on toggle
  • Show Active Playbooks toggle
  • Priority - This determines the attachment order of playbooks for the alert. Only one playbook can be attached automatically and it works according to priority order.
  • Environments (multi-select option)
• Menu : Before clicking on the menu icon to perform bulk actions, make sure to click the edit icon and select the required playbooks or blocks. Clicking on the menu opens up the following actions:
  • New Folder: Adds new playbooks folder
  • Duplicate: Click to create a duplicate playbook with the following options:
    • Keep or change priority
    • Keep in same folder or move to a different folder
    • Choose environments it belongs to. Options include single or multiple environments or All Environments, where all means all defined environments as well as environments that will be defined in the future.
  • Export and Import: Useful for sending both playbooks and playbook blocks from staging to production server and the other way around. The playbooks will be exported or imported with their customized views attached. The system only recognizes zip files for import. 
  • Move to: Can move playbooks and blocks to another folder or even create a new folder from this option. 
  • Delete: Delete playbooks and blocks

Top Bar of Playbook Designer

At the top segment of the playbook designer pane, you can use the horizontal toggling button to enable or disable the playbook. In addition, you can view a summary of the playbook that includes the playbook name, name of the user who created the playbook, playbook creation timestamp, name of the environment for which the playbook was created and a brief description of the playbook. You can also enable the simulator and add a customized view from the top bar.

The following actions are available directly under the top bar:

Icon	Description
	Open Step Selection opens a side drawer with available Triggers, Actions, Flow, and Blocks.
	Fit to screen automatically resizes the playbook so that it is displayed in its entirety on the screen.
	Reverts the playbook to its default arrangement.
	Zoom in to one or multiple steps in the playbook.
	Lets you download the playbook as a PNG file.
	Undo any changes that you have made.
	Redo any changes that you have previously undone.
	Playbook monitoring displays the individual playbooks statistics.
	Playbook Navigator displays all the actions and flows in a playbook.

For more information, refer to:

Define Customized Alert Views from Playbook Designer

Working with Playbook Simulator

Understanding Playbook Monitoring

Using Playbook Navigator