Task 4. Add custom playbook features - Use an out-of-the-box playbook, create a new playbook, or customize an existing one based on your organization's needs. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Configure a sub-playbook loop

Automate the execution of a series of actions in a sub-playbook loop to enable handling repetitive tasks efficiently, increasing workflow productivity and consistency.

Filter and transform data

Filters extract relevant data to help focus on relevant information and discard irrelevant or unnecessary data.

Transformers take one value and transform or render it to another value or format.

Use scripts

Perform specific automated actions using commands which are also used in playbook tasks and in the War Room.

Configure script error handling.

Extract indicators

Extract indicators from issue fields and enrich them using commands and scripts defined for the indicator type.

Extended contextExtend context

Save additional data from the raw response of commands that return data.

Update issue fields with playbook tasks

Use the setIssue script to set and update all system issue fields.

Create an automation rule

Create conditions so if an issue with specific characteristics is created, a suitable response is issued via a playbook.

Use playbook pollingPlaybook polling

Configure a playbook to stop and wait for a process to complete on a third-party product, and continue when it is done.