Task 4. Add custom playbook features - Use an out-of-the-box playbook, create a new playbook, or customize an existing one based on your organization's needs. - Administrator Guide - 8.5 - Cortex XSOAR - Cortex

Task 4. Add custom playbook features - Use an out-of-the-box playbook, create a new playbook, or customize an existing one based on your organization's needs. - Administrator Guide - 8.5 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR On-prem Documentation

Product

Cortex XSOAR

Version

8.5

Creation date

2024-03-10

Last date published

2025-04-20

End_of_Life

EoL

Category

Administrator Guide

Solution

On-prem

Abstract

Use an out-of-the-box playbook, create a new playbook, or customize an existing one based on your organization's needs.

Customizing a playbook helps you automate tasks to match your needs, making workflows more efficient, accurate, and easier to integrate with your existing processes.

You can customize your playbook to do the following.

Custom action	Description
Customize the SOC name	Customize the name of the SOC that appears in the survey header.
Add a sub-playbook	Playbooks can be divided into two categories, depending on their use. Parent playbooks are playbooks that run as the main playbook of an incident. For example, Phishing - Generic v3. Sub-playbooks are playbooks that are nested under other playbooks. They appear as tasks in the parent playbook flow and are indicated by the sub-playbook icon. A sub-playbook can also be a parent playbook in a different use case. For example, IP Enrichment - Generic v2.
Field mapping	You can map output from a playbook task directly to an incident field. This means that the value for an output key populates the specified field per incident. This is a good alternative to using a task with a set incident command. You can map when you select a script in a Standard or Conditional task. For more information, see Create a standard task.
Filter and transform data	Filters extract relevant data to help focus on relevant information and discard irrelevant or unnecessary data. Transformers take one value and transform or render it to another value or format.
Use scripts	Perform specific automated actions using commands that are also used in playbook tasks and in the War Room. Configure script error handling.
Extract indicators	Extract indicators from incident fields and enrich them using commands and scripts defined for the indicator type.
Extend context	Save additional data from the raw response of commands that return data.
Set and update incident fields	Use the setIncident script in a playbook task to set and update incident fields.
Use playbook polling	Configure a playbook to stop and wait for a process to complete on a third-party product, and continue when it is done.