Playbook Tasks

LAST UPDATED: MAR 3, 2025

Tasks are the building blocks of automation playbooks, driving workflows through predefined actions tailored to business requirements, data transformations, and decision logic. Where necessary, interactive elements may be integrated to provide enhanced flexibility and operational oversight.

For each playbook type, the most commonly used task types are immediately visible in the task menu, while additional task types are organized under the image 27 (3)-20250213-182224.png popover menu.

Task Types and Sample Data

Playbook tasks serve different functions, some shared between preprocessing and investigation playbooks, others exclusive.

Preprocessing Playbooks Only

Both

Investigation Playbooks Only

Command*
Conditional*
Data Formatter
Stage
Rest API
Unwind*
Merge*
Morpheus AI* NEW
Lock*
Unlock*

VIEWING SAMPLE DATA

* Task types marked with an asterisk allow users to view sample input and output data formats.

Group 33.png — **Sample Input Data for an Integration Command**

Relationship Between Tasks with Triggers

Key Principles

The mere existence of tasks in a playbook does not guarantee their execution.
Executable tasks must be connected to an upstream trigger. Orphan nodes will not execute.
Tasks downstream of a trigger can execute if and only if the trigger's activation condition is met.
- See ‎Preprocessing Playbook Triggers and ‎Investigation Playbook Triggers
Even when a trigger activates, some tasks may not execute to completion due to:
- Conditional Logic – Branching control flow may exclude certain task paths.
- Human Interaction – Tasks requiring user input or approval may pause flow progression.
- External Dependencies – Commands involving API calls may be affected by configuration settings or rate limits.

Task Input Data

Static	Dynamic

Static Input

Static inputs refer to input values that remain constant throughout execution, such as predefined parameters for commands or fixed configuration settings.

Static Input Examples

EXAMPLE: Ingestion Command Parameters

EXAMPLE: Task Dropdown Fields

Dynamic Input

Dynamic inputs refer to data whose values may vary based on context and task outcomes. See‎ Dynamically Selecting Data to learn more.

Task Output Data

Output Types

Task outputs are categorized into key fields, context data, return data, raw data, result, and playbook data. While some categories may be absent depending on the command, return data is always present.

Key Fields: Meant to present pertinent command output values in a label-above-value format, minimizing nesting to one level, rarely two, as an alternative to raw code.

Context Data: Meant to hold command-specific contextual data. May be identical to Raw Data in some cases.

READER NOTE

D3 has discontinued the use of context data (CD) in all newly developed commands.

EXAMPLES

Integration: Gmail | Command: Send Email | CD: PRESENT

Integration: Gmail V2 | Command: Send Email | CD: ABSENT

Integration: ServiceNow | Command: Get SysID | CD: PRESENT

Integration: ServiceNow v2 | Command: Get Sys ID | CD: ABSENT

Integration: Splunk | Command: Get Application List | CD: PRESENT

Integration: Splunk v2 | Command: Get Application List | CD: ABSENT

Integration: Splunk | Command: Check IP Reputation | CD: PRESENT

Integration: Splunk v3 | Command: Check IP Reputation | CD: ABSENT

Return Data: Indicates whether the task executed successfully, partially successfully, or failed.

READER NOTE

In check reputation commands, return data converts raw risk scores into D3-defined risk levels and names, enriching artifacts with reputation details.

Raw Data: The majority, if not all, of the pertinent API response data.