Cortex XSOAR playbooks and tasks have inputs (data from incident or integration) and outputs that can then be used as input in other tasks.
Playbooks and playbook tasks have inputs, which are data pieces that are present in the playbook or playbook task. The inputs are often manipulated or enriched and they produce outputs. The inputs might come from the incident itself, such as the role to whom to assign the incident, or an input can be provided by an integration. For example, when an Active Directory integration is used in a task to extract a user's credentials.
You can add playbook inputs from incident context data and from indicators. Some playbooks, such as Threat Intel Management playbooks, use indicators as the playbook input. If you have a TIM license, see Threat Intelligence Management Playbooks in the Threat Intel Management Guide to learn more.
Example Using Incident Context Data as the Playbook Input
The following example uses incident context data as the playbook input from the Access Investigation - Generic playbook.
Click the top task Playbook Triggered. The playbook is triggered based on incident context data.
Inputs
The first two inputs are SrcIP, retrieved from the incident.src key, and DstIP, retrieved from the incident.dest key.
Outputs
The Access Investigation - Generic playbook creates an output object that can be used in subsequent playbook tasks.
For example, the Access Investigation - Generic playbook Endpoint.IP output creates a list of endpoint IP addresses which can later be enriched by an IP enrichment task, and the Endpoint.MAC output creates a list of endpoint MAC addresses which can be used to get information about the hosts that were affected by the alerts.
Outputs can also be data that was extracted or derived from the inputs. For example, the Access Investigation - Generic playbook contains the Account Enrichment - Generic v2.1 sub-task, which uses the account username (and optionally domain) as input to Active Directory to retrieve user information as output, such as the user's email address, manager, and any groups to which they belong.
An output can then serve as input for a subsequent task. For example, in the Account Enrichment - Generic v2.1 task, the Get account info from Active Directory task output Account.Username is used as an input for the Active Directory - Get User Manager Details task to retrieve manager details for that user.
For information on giving sub-playbooks access to main playbook data, see Incident Context Data.
Playbook Input and Output Groups
Playbook input and output fields are now collected into groups in the the top task Playbook Triggered. This organizes the inputs and outputs, providing clarity and context to understand which inputs are relevant to which playbook flow. For example, the following playbook inputs are grouped under Mailbox selection, Sub-playboooks activation, and Analyst Assignment.
Users with permission to edit playbooks can add, edit, and delete groups and input and output fields. Users without this permission can only view groups, inputs, and outputs.
Manage Groups
You can do the following with groups:
Add or delete a group. Deleting a group deletes all the fields defined in the group.
Change the name and/or description of the group.
Change the order groups appear by drag and drop.
Collapse and expand a group.
Click + Add Input Group or + Add Output Group.
Enter a group name and description and select the check mark.
Add fields to the group.
Note
If you do not add any fields, the group will be deleted when you click Save.
Manage Input or Output Fields in a Group
You can do the following with input or output fields within a group:
Add, edit, or delete fields within a group. Input or output fields are always part of a group.
Move fields between groups by drag and drop.
Change field order within a group by drag and drop.
Inputs
Within a group, click + Add Input at the bottom of the list of input fields. You may need to scroll down to see this option.
Enter the input field Name (required), Value, and Description.
When you are done adding fields, click Save.
Outputs
Within a group, click + Add Output or + Add Manually at the bottom of the list of output fields. You may need to scroll down to see these options.
If you click + Add Output, select from the outputs from previous tasks.
If you click + Add Manually, enter the context path and description for the output.
When you are done adding fields, click Save.