Nested Playbooks

LAST UPDATED: APRIL 15, 2025

Embedded within parent playbooks, a nested playbook (listed as Codeless Playbook in the platform) is one of two implementation types for custom integration commands and custom utility commands. Nested playbooks are identifiable and accessible through the image 1 (3)-20250415-173231.png (link) icon displayed on command task nodes.

Why Build and Use Nested Playbooks

Nested playbook commands offer operational and maintenance benefits as compared to implementing all logic directly within a single parent playbook. Benefits include:

Reusability – Reduces repetitive configuration for common actions.
Standardization of Processes – Ensures consistent incident response procedures, particularly in high-pressure or time-sensitive situations.
Enhanced Readability – Makes it easier to understand and follow response logic during investigations.
Improved Maintainability – Makes it easier to manage and update common logic.
Easier Testing and Debugging – Enables troubleshooting and validation of specific actions without executing the entire parent playbook.

READER NOTE

While termed "codeless," some task nodes require Jinja expressions to perform dynamic logic.

Creating Nested Playbooks

Example 1 - Creating My First Nested Playbook (Custom Integration Command)

Navigate to Configuration > Integration Command, then select an integration.
Click on the button.
Select the Codeless Playbook implementation type, name the custom command, then click on the button.
Build the following sample nested playbook:
Click on the root node (DemoNestedPlaybook), select the Command Task checkbox, then save the task configuration.
Submit the nested playbook.
Verify that the nested playbook is in mode.

Example 2 - Creating My Second Nested Playbook (Custom Utility Command)

Navigate to Configuration > Utility Command, then click on the button.
Select the Codeless Playbook implementation type, name the custom command, then click on the button.
Build the following sample nested playbook:
Click on the root node (DemoNestedPlaybook), select the Command Task checkbox, then save the task configuration.
Submit the nested playbook.
Verify that the nested playbook is in mode.

Testing Nested Playbooks

See Playbook Testing and Task Node Re-runs.

Adding Nested Playbooks to Parent Playbooks

Example 1 - Embedding My First Nested Playbook (Custom Integration Command)

1. Navigate to Configuration > Investigation Playbooks (or Preprocessing Playbooks), then find and select a playbook.

Search for the nested playbook command task, then drag and drop it onto the parent playbook editor.
Verify that the nested playbook command task has been added to the parent playbook editor.
View the nested playbook by clicking on the (link) icon.

Example 2 - Embedding My Second Nested Playbook (Custom Utility Command)

Navigate to Configuration > Investigation Playbooks (or Preprocessing Playbooks), then find and select a playbook.

Search for the nested playbook command task, then drag and drop it onto the parent playbook editor.
Verify that the nested playbook command task has been added to the parent playbook editor.
View the nested playbook by clicking on the (link) icon.

RELATED ARTICLES