Task 1. Choose from out-of-the-box playbooks or customize your own - Use an out-of-the-box playbook, create a new playbook, or customize an existing one based on your organization's needs. - Administrator Guide - 8.5 - Cortex XSOAR - Cortex

Task 1. Choose from out-of-the-box playbooks or customize your own - Use an out-of-the-box playbook, create a new playbook, or customize an existing one based on your organization's needs. - Administrator Guide - 8.5 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR On-prem Documentation

Product

Cortex XSOAR

Version

8.5

Creation date

2024-03-10

Last date published

2025-04-20

End_of_Life

EoL

Search for an out-of-the-box playbook

Search for a playbook that is included out-of-the-box with Cortex XSOAR or after downloading from Marketplace.

In the Cortex XSOAR Playbooks page, use free text in the search box to search for playbooks. You can search using part or all of the playbooks' names or description. You can also search for an exact match of the playbook name by putting quotation marks around the search text. For example, searching for "Block Account - Generic" returns the playbook with that name.

Search for more than one exact match by including the logical operator "or" in-between your search texts in quotation marks. For example, searching for "Block Account - Generic" or "NGFW Scan" returns the two playbooks with those names. Wildcards are not supported in free text search.

Tip

You can also browse Marketplace to check for out-of-the-box playbooks that you can customize for your process. For an extensive list of available out-of-the-box playbooks, see Generic Playbooks.

Customize an out-of-the-box playbook

When installing a playbook from a content pack, by default, the playbook is attached, which means that it is not editable (apart from some input values).

To edit the playbook, you need to detach or make a duplicate. While it is detached, the playbook is not updated by the content pack. This may be useful when you want to update the playbook without breaking customization. If you want to update the playbook type through content pack updates, you need to reattach the playbook, but any changes are overridden by the content pack on upgrade. If you open an attached playbook in a tab, it can be detached from within the editor page.

If you want to keep the changes, duplicate the playbook before reattaching it.

Go to Playbooks and click + New Playbook.
Enter a name for the playbook and click Save.
A blank playbook opens with the Playbook Triggered task that holds the playbook inputs and outputs.

Note

To open multiple playbooks at the same time, edit the first playbook and then click New next to the playbook name to create a new tab. You can either create a new playbook, or add an existing one.
You can view recently modified or deleted playbooks by clicking version history for all playbooks .