Skip to main content
Skip table of contents

Playbook Library

LAST UPDATED: JAN 6, 2024

Overview

The Playbook Library provides pre-built templates tailored to common cybersecurity threat investigation scenarios. Users can leverage these templates to streamline playbook creation.

Group 38.png

Accessing the Playbook Library

There are two ways to access the playbook library.

On the playbook landing page

  1. Navigate to Configuration > Preprocessing Playbooks (or Investigation Playbooks).

    Group 39.png

  2. Click on the View Playbook Library button.

    Group 40.png

Within a playbook

  1. Navigate to Configuration > Preprocessing Playbooks (or Investigation Playbooks).

    Group 39.png

  2. Click into a playbook.

    Frame 78 (13)-20241227-195740.png

  3. Click on the Group 38.png button beside the task menu.

    Group 42.png

Using a Template

  1. Use the left-hand menu to browse through different categories.

    image 57 (1)-20250103-171431.png

  2. Click on a playbook card to open its template.

    Group 78.png

  3. Observe and use the template as needed.

    Frame 134 (3)-20250103-172644.png

    1. Hover over a task node, then click on the the icon to copy a single task.
      Refer to Pasting Template Tasks for instructions on pasting a task onto the playbook canvas.

    2. Click on the button export the entire template playbook as an XML file.

How can a playbook be imported?

READER NOTE

  • Playbooks must be imported as their respective types.

  • Attempting to import a playbook into the wrong category (e.g. importing an investigation playbook as a preprocessing playbook) is not allowed.

Group 57.png

  1. Navigate to Configuration > Investigation Playbooks (or Preprocessing Playbooks).

    Frame 137 (3)-20250103-174301.png

  2. Click the Group 54.png button.

  3. Click on the Browse button.

    Frame 136 (2)-20250103-173958.png

  4. Select the XML file.

  5. Click on the Import button.

    Frame 135 (2)-20250103-173804.png

Pasting Template Tasks

  1. Open a playbook.

    Frame 82 (4)-20241227-201256.png

  2. Right-click on the playbook canvas, then click on the Paste task here button (or press Ctrl + V).

    paste_task.gif

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close