Task 3. Add objects from the Task Library - Using the Task Library, add Quick Actions, scripts and commands, sub-playbooks, and tasks to customize or create a new playbook. - Administrator Guide - Cortex CLOUD

Standard

Standard tasks can be configured to prompt for a response, such as prompting an analyst to verify the severity or classification of an issue before proceeding with automated actions. They can also be automated tasks such as parsing a file or enriching indicators.

Automated tasks are based on scripts that exist in the system. These scripts can be created by you or come out-of-the-box as part of a content pack. For example, the !ad-get-user command retrieves detailed information about a user account using the Active Directory Query V2 integration.

You can also automatically remediate an issue by interacting with a third-party integration, open tickets in a ticketing system such as Jira, or detonate a file using a sandbox.

AI Prompt

AI tasks use natural language prompts to interact with the Cortex Cloud built-in LLM. You provide the inputs and the LLM generates the outputs.

AI tasks enable your playbook to perform complex analysis, generate reports, create emails, and generate responses dynamically.

Conditional

Conditional tasks validate conditions based on values or parameters and take appropriate direction in the playbook workflow, like a decision tree in a flow chart.

For example, a conditional task may ask whether indicators are found. If yes, you can have a task to enrich them, and if not you can proceed to determine that the issue is not malicious. Alternatively, you can use conditional tasks to check if a certain integration is available and enabled in your system. If yes, you can use that integration to perform an action, and if not, you can continue on a different branch in the decision tree.

Conditional tasks can also be used to communicate with users through a single question survey, the answer to which determines how a playbook will proceed.

Data Collection

Data collection tasks interact with users through a survey, for example to collect responses or escalate an issue.

All responses are collected and recorded in the issue context data, from a single user or multiple users. You can use the survey questions and answers as input for subsequent playbook tasks.

You can collect responses in custom fields, for example, a grid field.

Section Header

Use a section header task to group related tasks to organize and manage the flow of your playbook.

For example, in a phishing playbook you would have a section for the investigative phase of the playbook such as indicator enrichment, and a section for communication tasks with the user who reported the phishing.

You can easily navigate playbooks and focus on the parts you need to work on by collapsing and expanding playbook sections. Collapsing sections provides a condensed view of the playbook flow, reducing visual clutter and enabling quick access to specific sections. Expanding sections allows you to view or edit specific parts of a playbook while keeping the rest of the playbook compact and maintaining focus on the relevant playbook details. You can also hover over a section header to highlight all tasks under the section and easily identify the section scope.