Event Playbooks

LAST UPDATED: OCT 11, 2024

Overview

The Event Playbook uses D3 SOAR's codeless playbook editor to allow you to create standardized workflows for ingested events from different integrations. You can create multiple event playbooks and select which playbook to run for each scheduled event ingestion. An event playbook can be triggered to run in two different stages of an event's life cycle in D3 SOAR: On Event Ingestion, and After Event Dismissal.

You can create, view, and edit all event playbooks in Configurations > Event Playbooks.

Event playbooks can help SOC Managers automate standard procedures applied to ingested events and reduce time spent by an analyst executing these procedures manually.

This document will provide all the information needed to help you build and use an event playbook in D3 SOAR.

UI Elements

This section outlines all of the notable UI features of the event playbook. Each element will be explained in more detail in the following Features section.

Action Bar

Breadcrumbs

The relative path of your location within Configurations

Shared tag (Multi-tenancy only)

Represents the sharing status of this playbook from the master vSOC

Concurrent Users

All the current users viewing/editing this playbook are displayed here in their initials.

Draft/Live status

Represents the playbook’s draft/live status

Actions

The list of actions you can perform on an event playbook:

1. View Live / View Draft

2. Submit

3. More Actions

   1. Clone

   2. Replace

   3. Delete

   4. Version History

   5. Command References

Task Panel

Add New Tasks

Drag and drop one of the 10 task types into the editor to build your playbook workflow

Quick-add Tasks

Drag and drop specific command tasks into the editor to build your playbook workflow

Main Editor

Viewing Options

1. Overview

2. Zoom In/Out

3. Fit to screen

4. Print

5. Refresh

Local Shared Data

A data storage area where you can save reusable information for different tasks to utilize

Trigger Output Data

Stored event data that is returned after the event playbook has run.

Search

A wildcard search through all the playbook tasks currently in the editor

Test

Test the playbook with sample event data to verify your workflow

Task Detail Panel

View the detailed configurations and inputs of each task

Features

Triggers

In an event playbook, each task chain must be connected to a trigger. Each task chain is only run when the trigger condition is satisfied. Currently, event playbooks have two triggers:

1. On Event Ingestion – Tasks connected to this trigger run when raw event data is ingested and field mapping, artifact extraction, and system reputation check is completed

2. After Event Dismissal – Tasks connected to this trigger run immediately after an event is dismissed

You should use these triggers to help you classify which workflows to run depending on the stage of the event life cycle an event is currently in.

Draft/Live Modes

There are two playbook modes in the event playbook:

Collaboration and Concurrent Users

When collaborating with other users on a playbook, it’s essential to know if you are on the same playbook and what changes each of you is making. Seeing concurrent users is also important when working independently on a playbook so that you are aware of where other users are, and no crucial data is unknowingly overridden.

Concurrent Users at Playbook Level

Every user currently working on the same playbook will appear on the toolbar as coloured circles with their initials. When you hover over a specific user, you can see their name. The toolbar can display up to five users’ initials. However, if the total number of concurrent users exceeds five, the 5th circle will show you how many more people are here on this playbook. When you hover over that number, you will see a list of their names.

Concurrent Users at Task Level

When a user is on a specific playbook task, whether they’re viewing or editing it, you will see an outline in their colour around the task they're on. When you hover over the task, it tells you exactly who the user is.

In the case of multiple users on one task, you can hover over the task to see everyone’s name.

Concurrent Users at Field Level

To view a specific field that a user is editing, click on the task to open up the task configuration panel. The field being edited will be outlined in the editor's colour. When you hover over the field, you will see the editor's full name at the bottom right corner. However, concurrent users at field level can only be seen when the playbook is in draft mode.

In the case of multiple users on the same field, you can hover over the field to see everyone’s name. Fields are automatically saved when you click away from the input box.

Concurrent Editing and Saving

View Draft / View Live

As mentioned in the above section, a playbook can have two modes, a live mode, and a draft mode. When another user clicks on the Edit button while you are viewing a playbook, a draft mode is created for the other user to edit. You will remain on the live mode so that your viewing is not interrupted. If you want to edit or view the changes made by the other user, you can do so by clicking on the View Draft button. You can exit the draft mode at any time by clicking on the View Live button.

Submit Changes with Concurrent Editors

When you’ve finished editing and want to make the changes go live, the system will notify you if another user is still editing a field. You can choose to cancel your submission or submit it anyway. However, doing the latter may cause data loss or overridden changes on the fields they were editing.

In the event that other users submits their edits to go live while you are still editing a field, you will see the following notification:

You can then choose to see the newest live view or open a draft view of the most recent live view to continue your edits.

Version History

A version of the playbook is saved every time it goes live. Each version contains the DateTime the playbook went live and the user who performed this action. You can access all previous versions of this playbook by clicking on the More button located in the top right and clicking on Version History.

To restore to a previous version of a playbook

1. Make sure this playbook has gone Live at least once

2. Click on More button > Version History

3. Click on Export this version for the version you want to restore to

4. Navigate back to the playbook and make sure the playbook is in Draft mode. You can do so by clicking on the Edit button if the playbook is still in live mode.

5. Click on More button > Replace Playbook

6. Browse and select the playbook XML file that was exported in step 3

7. Click Replace

Local Shared Data

The local shared data allows you to store data in JSON format for tasks to reuse in a playbook. This storage area is local – data stored here is only accessible by this playbook and this playbook only. This feature may be helpful in situations where there are data (e.g. URL reputations) you want to be accessible by any tasks regardless of their playbook path.

There are four utility commands in D3 SOAR to help you manipulate data in the local shared data:

To add and retrieve data from local shared data

In this example, we want to save URL reputation data from a task to the local shared data and add this data to a global list in the system.

1. Drag the command task Add Root Key for Local Shared Data and drop it right after the Check URL Reputation task

2. In the command input area of Add Root Key for Local Shared Data:

   1. Input

      1. Select the path of the output of the Check URL Reputation task

   2. JSON Path

      1. Enter $.URLReputationData

3. In Add to Global List command task, make sure Dynamic input is enabled and click on …

4. Select Local Shared Data from the data source dropdown

5. Select the path $.URLReputationData

6. Test the playbook

Trigger Output Data

After running the Event Playbook, the event data structure will change as a result of data processing. The returned data is stored as the latest event playbook output data in JSON format. This is known as the trigger output data.

Store trigger output data

You can test run the event playbook by choosing a trigger and storing the subsequent trigger output data. Below is a detailed step-by-step on how to populate the trigger output data.

1. Navigate to Configuration

2. Click on Event Playbook tab

3. Open an Event Playbook

4. Click on the Run button

5. Build Test Data

6. Select an Integration & Connection

Click on Next and Build

After running the playbook, data will display inside the trigger output data.

Modify and get trigger output data

You can edit the trigger output data to optimize your work in two ways

• Utility Command

• Passdown Task

Utility Command

There are two built-in utility commands to help you get or update trigger output data.

Update Root Key Value for Trigger Output Data with JSON Path

In this example, we want to update the Data field within the trigger output data.

1. Drag a command task Update Root Key Value for Trigger Output Data with JSON Path and drop it right after the On Event Ingestion task.

2. In the command task, select the source type, and input the JSON path and updated value.

   1. Source Type - Select the source type to update

   2. JSON Path - Input the path you want to update the value. In this case, our path will map to the $.Data value within the trigger output data.

c. Updated Value - Input the value to update and save in the trigger output data

3. Save the task and run the test.

Passdown Task

The passdown task allows the user to pass playbook returned data or custom data and write it other destinations. In the case of trigger output data, new data can be written and updated into the existing trigger output data. This can be done by selecting the destination field as the trigger output data.

1. Drag the Passdown task and drop it right after the On Event Ingestion task.

2. In the command task, select the destination field, and input the destination JSON path and data.

   1. Destination Field - Select the destination fields you want to make a change to. In this case, we will update the trigger output data.

   2. Destination JSON Path - Input the specific path you want to update. We will write the new data into the $.Data path within the trigger output field.

c. Data - Input the desired data and save in the trigger output data

3. Run the Task

View trigger output data

Format Builder

Select the trigger output data as a data source on the top left of the window and click on a specific path to view its details.

Playbook Test

The event playbook allows you to test your workflow while you are editing it in Draft mode. You can use this feature to test the validity of your playbook while you are building it. The playbook editor offers testing at three different levels:

1. Playbook Level

2. Task Level

3. Input Level

Playbook Level

You can test your entire event playbook workflow to see if everything is working as intended by clicking on the Test ▶ button in the action bar. When testing, there are two options: test with an existing event to simulate event ingestion, or building custom sample data to be tested.

After your first test run, you might see various icon(s) appear in each Task card. These icons represent the current status of the Playbook task, and you can click on the icon(s) to view the Playbook Task Details in the pop-up window.

You can click on the icons to view the task details and status. Within the pop-up window, the top panel

You can click on the icons to view the task details and status. Within the pop-up window, the top panel highlights the Task Type, Assignee, Due Date, Status, Run Mode and action buttons of the playbook task. If not run, the first tab within this window presents the Input tab. You can review the contextual data in the Input tab, and update the input fields before running or skipping the Playbook Action. To run the task, click on the "Run/Done" button.

When you choose to skip a task, you can skip to the next task in the flow without having to run the previous task.

Test playbook with an existing event

1. Click on Test ▶

2. Select the site of the event you wish to test

3. Select the event

4. Click on Run Test

Test playbook with a custom trigger event

1. Click on Test ▶

2. Select your trigger type and click on Build Test Data

Example: On Event Ingestion

7. Select your integration to retrieve sample event data from and select a connection

8. Click on Next

9. Fill in your fetch event search parameters and click on Next

10. Review the raw event data fetched. If you are satisfied with the event data, click on Build

11. Click on Run Test

Task Level

On the task level, you can test a single task with specified input parameters and view the resulting output. Before testing at the task level, you will have to test the entire playbook at least once first to ensure there is data to test with. This can be done by clicking on the Test ▶ button in the action bar. Testing a task can help you ensure that it is well configured before moving on to creating the next step of your workflow.

To test a task

Input Level

On the Input level, you can test your inputs to make sure it satisfies the command parameters. Before testing at the input level, you will have to test the Playbook at least once first to ensure there is data to test with. Testing an input is especially useful when you are configuring a dynamic input - testing here can ensure the correct JSON path has been picked, or the correct data transformation has been applied.

To test an Input in a Command Task

To test an Input in a Data Formatter Task

Tasks

Playbook Tasks are the building blocks of a playbook. Tasks take in input data, perform data processing, and return output data. These tasks are connected to each other using control flow, and data flows from left to right starting from the source node. There are 10 Playbook Tasks with which you can use to build or edit a Playbook:

1. Command Task

2. Interaction Task

3. Conditional Task

4. Data Formatter Task

5. Stage Task

6. SLA Task

7. REST API Task

8. Passdown Task

9. Merge Task

10. Unwind Task

To use a playbook task, simply drag and drop the task you want to use from the playbook side panel into the Main Editor. A new node will be created and connected to the preceding node via a line.

Task Data Flow

Each Task can take in input data, perform data processing, and return output data. You can link Tasks together in the Main Editor with arrows that represent data Control Flow. The following section will explain the data flow of Tasks.

Input

A Task can take in both static and dynamic inputs.

A static input means that the input is fixed and will not change. For example, in a Fetch Event Command Task, you can set a fixed start/end date for the Events you are fetching for. However, if your workflow requires a moving time window for the Fetch Event command to fetch from, you will need to use a dynamic input.

There are 5 types of dynamic input methods for a Task. They are:

1. Dynamic Input

2. Data Formatter

3. HTML Editor / Data Formatter

4. DateTime / Data Formatter

5. Dropdown

Dynamic Input

Dynamic Input is the most common input type in a Playbook - it allows for both static and dynamic data to be used as an input for a Task. This feature can help you transfer data from one Task to another in a Playbook and chain Tasks together.

Static Data: Enter in the values that match the data type into the text area

Dynamic Data: Enable the dynamic toggle and enter the corresponding JSON Path of the dynamic data. This JSON Path should point to a data source that is dynamically updated in the Playbook. Optionally, you can apply regular expressions on this data through the Regex Filter tab to filter the JSON data.

Data Formatter

Data Formatter input allows you to use formatted dynamic data as an input for a Task. It is similar to Dynamic Input - but in addition, the Data Formatter allows you to perform complex data transformation on the data with our library of Jinja filters. With this, you can customize and create very specific dynamic inputs for a Task. The Quick Start guide in the Data Formatter contains more information on how to use this feature.

HTML Editor / Data Formatter

As the name suggests, this input method is the combination of HTML and Data Formatter. This input type is the same as Data Formatter, with the added ability to switch between the Data Formatter editor and a HTML editor. This allows you to build customized HTML templates that contain formatted dynamic fields that update automatically.

Date / Time Input

Date / Time input allows you to select a specific Date and Time as a static input for a Task. If your workflow requires a dynamic Date/Time input, you have the option to use the Data Formatter to select and format a dynamic input as the Date/Time input for a Task.

Dropdown Input

Static Data: Dropdown input allows you to select a value from a predefined list as an input for a Task.

Dynamic Data: You can define a JSON path or formatted data that outputs a value corresponding to one of the dropdown options. The playbook will dynamically select the matching value (from the JSON path or formatted data) in the dropdown when run.

Control Flow

All playbook tasks have an order of execution that determines which playbook task runs first, how often they run, whether they loop, etc. You can set a task to run if a condition is satisfied, thus creating branching flows; tasks can also run in a loop. The order of execution of playbook tasks is called a Control Flow.

There are a few types of Control Flow used in D3: sequencing, conditional branching, looping, wait for all, wait for any, and nesting.

Control Flows are represented by a directional line within the playbook. A playbook task will be triggered to run after the directly preceding task finished running. All playbook tasks can only be triggered and run once, except for when you set tasks to run in a loop.

There are a few examples of different types of Control Flow that are often used in D3:

Task Options

Every task has a few options for its run, to ensure the smooth configuration of the playbook. This can include: Active, Auto Run, Required, Stop on Error, and Long Run.

Output

There are five types of task output. The output of each task in runtime is yielded in the formats: Output Data, Context Data, Result, Return, and Raw Data. If the playbook task encounters an error, there will also be an Error tab. After running a playbook, you can click on each task to view the task output details.

Task Types

Command Task

Command task is one of the most important task types in D3 SOAR. The command task allows you to utilize D3’s library of built-in commands and 2000+ integration commands to perform tasks including data processing, data transformation, system actions and much more. It is essential to every playbook as it connects our system with third-party integrations.

Our system has four different types of commands:

1. Third-party integration commands

2. System Commands

3. Utility Commands

4. Cyber Commands

In addition to the built-in commands, you can build your own custom commands with Python or D3’s Codeless Playbook Editor.

All Command Tasks have the following basic elements:

Types of Commands

Nesting

A playbook functioning as a custom command with inputs and outputs which can be used in one or many other playbooks is called a nested playbook. It is very common that many playbooks share one or more the same small segments of the workflow. In order to reduce the repetitive configuration of the workflows, nested playbooks can be configured to accommodate the need for reusability of playbooks. One of these use cases is IP enrichment across multiple threat intelligence tools.

To create a nested Playbook

The following steps demonstrate the process of creating a sample nested playbook for IP enrichment:

Step 1: Create a New Utility Command

Step 2: Configure Command Setting, Inputs and Outputs

Step 3: Configure Playbook

Step 4: Publish and use the Playbook

Data Formatter Task

The Data Formatter Task lets you perform complex data transformations to playbook data. You can use D3’s built-in data filter to format and select specific playbook data and view the resulting output. The resulting reformatted output can be used as inputs for subsequent playbook tasks.

The example below demonstrates how you can add a data formatter to an event playbook to clean up URL data output from a preceding task. We will create a script in data formatter that removes duplicate URLs and ensures each URL is in a standardized format.

1. Give the task a relevant name that indicates what it does. In this example, we will name the task "URL Data Cleansing".

2. Input a custom Jinja script to select and format data. You can use the format builder to help you build a script by selecting the data source and filters you would like to use. Refer to the Quick Start guide for in-depth documentation on the available filters. In the following example, the script that cleanses the raw data and parses it into a JSON array:

   JSON

   {% set urlString = PlaybookData | jsonpath('$.DataSource.incident.Artifacts[*].URLAddress[*].Url') %}
   {% set result%}
   [
   {% for urlString in PlaybookData | jsonpath('$.["Extract URLs"].contextData') %}
       {% if urlString | last | equals("/") %}
       "{{result | plus (urlString[0:-1]) }}",
       {% else %}
       "{{result | plus (urlString)}}",
       {% endif %}
   {% endfor %}
   ]
   {% endset %}
   {{result | unique}}

   You can click Test to run and view your script’s output. The Data Formatter Output pop-up displays a bug log to help you troubleshoot if necessary. For our example, the output data was:

   JSON

   [
     "http://amazon.com",
     "http://google.com",
     "http://abc.com",
     "http://xmr.pool.minergate.com"
   ]

3. Configure the control flow for the command task. Use the tick boxes to configure if the command task is active, if it will auto run, and if it will stop when an error occurs. The dropdown menu lets you select the control flow for the task. Refer to Task Data Flow for more details. The configurations in this example ensure the command task is active, and will always auto-run when its preceding tasks have been completed.

4. Include a description for the data formatter task for future playbook editing reference if desired. We have not included one for this example.

5. Click the gray check mark button to confirm and create the command task.

6. Done!

Stage Task

The Stage Task lets you create checkpoints into a playbook’s workflow to organize playbooks. Stage tasks split the playbooks into different stages for easier management of workflows. Analysts can also use stage tasks to assign investigators to the event.

In this example, we will create a stage task in an event playbook to signify the data enrichment stage of the playbook workflow.

1. Give the stage task a relevant name that indicates the corresponding stage of your playbook’s workflow. In this example, we will name the stage task "Data Enrichment".

2. Configure the control flow for the stage task. Use the tick boxes to configure if the stage task is active and if it will autorun. The dropdown menu lets you select the control flow for the task. Refer to Task Data Flow for more details. The configurations in this example ensure the command task is active, and will always auto-run when its preceding tasks have been completed.

3. Include a description for the stage task for future playbook editing reference if desired. We have not included one for this example.

4. Click the gray check mark button to confirm and create the command task.

5. Done!

SLA Task

The SLA Task lets you set precise service-level agreement (SLA) for all tasks in the event response lifecycle. This task facilitates the reporting and monitoring of your team’s compliance with SLA guidelines.

In this example, we use an SLA Task to measure how long it takes the playbook to complete the escalation stage. This functionality is commonly used by SOC teams to ensure events are dismissed/escalated and handled within a reasonable time frame per SLAs.

1. Give the task a relevant name that indicates the SLA agreement. In this example, we will name the task "Event Dismissal SLA Start".

2. Select the SLA agreement for this task using the dropdown menu. Configured SLAs will be available to select. You can add custom SLAs in the settings module of D3 SOAR. For this example, we will select Event Dismissed in 15 Minutes. This means that the time limit to respond to an event is 15 minutes.

3. Define the SLA tracking stage for the task. With this configuration, you can select whether you want to start, pause, resume, stop or reset the SLA tracking task. For this particular SLA task in the example, we are adding the SLA task to start tracking when SLA tracking has started. We would need to add a Stop SLA task in the playbook to define when the SLA tracking will stop.

4. Select who should be notified when the SLA is breached using the dropdown menu. Investigation teams, groups, users, and roles will be available to select. For our example, we will notify Security of the task.

5. Configure the control flow for the SLA task. Use the tick boxes to configure if the stage task is active and if it will autorun. The dropdown menu lets you select the control flow for the task. Refer to Task Data Flow for more details. The configurations in this example ensure the SLA task is active, and will always auto-run when its preceding tasks have been completed.

6. Include a description for the SLA task for future playbook editing reference if desired. A brief description of the SLA is included in the example shown.

7. Click the gray check mark button to confirm and create the command task.

8. Done!

Conditional Task

The Conditional Task allows you to set up different possible paths a playbook workflow may go through depending on how the output of a preceding task runs through a logical test.

In this example, the Conditional Task checks which option a user has selected in an automated email sent by the D3 SOAR system inquiring if he/she has clicked on any malicious links.

1. Give the task a relevant name that describes the conditional task. In this example, we will name the task "Did the User click on the Link?".

2. Use the tick boxes to set whether the task is active and automated. Both boxes are checked in this example so that the task is active and will auto-run.

3. Select the condition type for the task (i.e. input or command). For the input condition type, you can build a custom Python script with the built-in data formatter to define the workflow for the conditionals. You can also select the command condition type, which allows you to use D3’s library of built-in and integration commands to define the workflow for the conditionals.

4. Configure the control flow for the conditional task. The dropdown menu lets you select the control flow for the task. Refer to Task Data Flow for more details. The configurations in this example ensure the conditional task will always auto-run when its preceding tasks have been completed.

5. Include a description for the conditional task for future playbook editing reference if desired. We have not included one for this example.

6. Add conditionals for the task. Conditionals correspond to the output data of the preceding playbook task. You can also change the order of the conditional options you have added. A common set of conditions is true and false, which we have used in this example.

7. Click the gray check mark button to confirm and create the command task.

8. Done!

Interaction Task

The Interaction Task is typically used to add a point of manual human processing into your playbook. With the Interaction Task, you can incorporate questions, prompts or notes to guide your SOC team’s decision-making process throughout an event response. Unlike other playbook tasks, an interaction task cannot be automated, as its purpose is to facilitate manual response in event response.

In this example, we will create an interaction task to prompt the investigator to manually select from a list of potentially malicious IP addresses from the dynamic output data of a preceding playbook task to block.

1. Give the task a relevant name that describes the interaction task. In this example, we will name the task "Which of the following IP addresses do you want to block?".

2. Add questions, prompts, information etc. that will guide the investigator’s manual processing of the task. You can use the JSON path picker to select output data and use the Regex filter to filter the JSON data. For this example, we added a question asking the investigator which IP address to manually block from the preceding playbook task’s output dynamic data of some potentially malicious IP.

3. Configure whether the interaction task is active and a required task. Both tick boxes are checked in our example so that the interaction task is both active and required.

4. Assign the group, user or role responsible for processing the interaction task. We have assigned the task to the investigator for this example.

5. Set the time constraint for the assignee to process the task. This setting can be used to align with any SLA requirements of your organization or use case. Here, we have set the time limit to process the interaction task to one hour.

6. Configure the control flow for the interaction task. The dropdown menu lets you select the control flow for the task. Refer to Task Data Flow for more details. The configurations in this example ensure the interaction task will always auto-run when its preceding tasks have been completed.

7. Include a description for the command task for future playbook editing reference if desired. We have not included one for this example.

8. Click the gray check mark button to confirm and create the command task.

9. Done!

Merge Task

The Merge Task lets you take in data from all preceding connected playbook tasks and combine the data based on specified conditions. Tasks that are connected after the merge task can then reuse the combined data.

In this example, we will create a merge task to combine data after an Unwind JSON Array command that deconstructed an array field from some JSON data of the risk levels of a list of IPs. The subsequent task after the Unwind JSON Array command queried the IP addresses using an integration command task. Since there was more than one data point, multiple instances of the query command task were configured to run. The merge task will now combine the data output of the different instances for use in later playbook tasks.

1. Give the task a relevant name. In this example, we will name the task "Merge".

2. Set the condition to control how the data is combined. There are four conditions you can configure to control how data is combined: by playbook instance, by task name, by task instance, or by a specified JSON path. For this example, we will combine the data by playbook instance.

3. Use the tick boxes to configure if the task is active, if it is automated, and if it will stop on error. Active and Auto Run are selected for this example.

4. Configure the control flow for the merge task. The dropdown menu lets you select the control flow for the task. Refer to Task Data Flow for more details. The configurations in this example ensure the interaction task will always auto-run when its preceding tasks have been completed.

5. Include a description for the command task for future playbook editing reference if desired. We have not included one for this example.

6. Click the gray check mark button to confirm and create the command task.

7. Done!

Unwind Task

The Unwind Task deconstructs an array of JSON object(s) into individual objects. More specifically, it deconstructs an array field from the specified JSON data and creates output(s) for each object of the array. Each returned object contains two parts: the root fields of the original JSON data and one object from the array. An instance is created for each returned object. 

In most use cases, if a command input can only accept one item at a time, we use the unwind task to repeat the command task to handle the loop of an array. The unwind task is often used in conjunction with a merge task to re-combine the data based on specified conditions.

REST API Task

The REST API Task lets you use REST APIs to send a request to a web service to retrieve or modify data in your playbooks. You can use the five HTTP methods for CRUD (create, retrieve, update and delete) operations.

In this example, we will create a REST API task to send a webhook event to D3 SOAR with the POST method in order to create a new event entry.

1. Give the task a relevant name that describes the REST API task. In this example, we will name the task "Send Webhook Event".

2. Configure the input parameters to use the REST API. This includes the request URL, the HTTP method, the request header and the body data for the request. In this example, the following values for the input parameters were configured:

   1. URL:

      CODE

      {{PlaybookData | jsonpath('$.["Construct Webhook URL"].returnData')|trim}}

      The request URL is selected using the format builder to select the data from a previous playbook task

   2. Method:
      POST
      We will use the POST request method to perform a create operation for a new event.

   3. Header:

      CODE

      {"d3key":"d3test"}

      The key-value pair is used for the API authorization.

   4. Body:

      CODE

      {% set result %}
      {
      "eventtype":"Suspicious Email",
        "username": "user1",
        "sourceip": "192.168.87.104",
        "hostname": "D3cyber7ce",
        "email": "demo@d3soar.com",
        "domain": "www.google.com",
        "destinationip": "8.8.8.8",
        "sha256": "8b2e701e91101955c73865589a4c72999aeabc11043f712e05fdb1c17c4ab19a",
        "timestamp": "{{'today' | date('YYYY/MM/DD HH:mm:ss')}}"
      }
      
      {%endset%}{{result|trim}}

      The body contains the JSON object data we want to POST into D3 SOAR.

3. Use the tick boxes to configure if the task is active, if it is automated, and if it will stop on error. Active and Auto Run are selected for this example.

4. Use the tick boxes to set whether the task is active and automated. Both boxes are checked in this example so that the task is active and will auto-run.

5. Include a description for the command task for future playbook editing reference if desired. We have not included one for this example.

6. Click the gray check mark button to confirm and create the command task.

7. Done!

Passdown Task

You can configure the Passdown Task to save the results of the executed Playbook Task and pass down its values into the Command Task’s output or any designated placeholder fields. This Task is only available in Event Playbooks and Commands - Codeless Playbook Implementation Method.

Selecting an Event Playbook

After setting up your event playbooks, you can select a specific event playbook to run for each integration. You configure this in two areas: Data Ingestion and File Upload.

Data Ingestion

The following instructions teach you how to configure a data ingestion schedule and select a specific event playbook to run when a fetch command is executed.