Work Plan - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

A Work Plan is a visual representation of the running Playbook that is assigned to an incident. Use it to monitor and manage a Playbook work flow.

The Work Plan is a visual representation of the running playbook that is assigned to the incident. Playbooks enable you to automate many of your security processes, including, but not limited to handling your investigations and managing your tickets. Work Plans enable you to monitor and manage a playbook workflow, and add new tasks to tailor the playbook to a specific investigation.

When clicking the Follow checkbox you can see the playbook executing in real-time.

In the Work Plan you can do the following:

  • View inputs and outputs of a playbook.

  • View, create, and edit a playbook task for each required step.

    When you create a task, add a name, script, and description. The name and description should be meaningful so that the task corresponds to the data that you are collecting.

    For each task you can do the following:

    • Designate tasks as complete either manually or by running a script.

    • Assign an owner for a task.

    • Set a due date for the task.

    • Add comments and completed notes, as required.

  • Re-run the playbook, zoom in and out, and export to a PNG format.

The color coding and symbols in the Work Plan help you to easily troubleshoot errors or respond to manual steps. The following table displays the color codes and their meanings.