Use or customize an existing playbook or create a new playbook based on your organization's needs.
You can use or customize an existing playbook or create a new playbook.
Navigate to Playbooks and in the Playbook Library search for the playbook you want to use.
Use free text in the search box to find an existing playbook. From the search drop down, you can:
Perform a basic search by Basic (name, description, and tag), Name, Description, or Tag.
Perform an advanced search by Script Name, Task Name, or Brand Name (third-party integration name) within playbooks.
You can search for an exact match of the script name by putting quotation marks around the search text. For example, searching for
"Block Account - Generic"returns the playbook with that name. You can search for more than one exact match by including the logical operator "or" in-between your search texts in quotation marks. For example, searching for"Block Account - Generic" or "NGFW Scan"returns the two playbooks with those names. Wildcards are not supported in free text search.You can sort the playbooks in the library alphabetically, by modified date, by system or custom, and you can filter for disabled or deprecated playbooks.
You can also browse Marketplace to check for out-of-the-box playbooks that you can customize for your process. For an extensive list of available out-of-the-box playbooks, see Generic Playbooks.
To edit the playbook, click Edit. If the playbook is locked, click
and select either Duplicate Playbook or Detach Playbook.When installing a playbook from a content pack, by default, the playbook is attached, which means that it is not editable (apart from some input values).
To edit the playbook, you need to detach or make a duplicate. While it is detached, the playbook is not updated by the content pack. This may be useful when you want to update the playbook without breaking customization. If you want to update the playbook type through content pack updates, you need to reattach the playbook, but any changes are overridden by the content pack on upgrade. If you open an attached playbook in a tab, it can be detached from within the playbook editor page.
If you want to keep the changes, duplicate the playbook before reattaching it.
Make changes in the playbook as needed, such as configuring playbook settings and adding tasks.
Navigate to Playbooks and click + New Playbook.
Enter a name for the playbook and click Save.
A blank playbook opens with the Playbook Triggered task that holds the playbook inputs and outputs.
Note
To open multiple playbooks at the same time, edit the first playbook and then click New next to the playbook name to create a new tab. You can either create a new playbook, or add an existing one.
You can view recently modified or deleted playbooks by clicking version history for all playbooks
.
You can easily navigate playbooks and focus on the parts you need to work on by collapsing and expanding playbook sections. Collapsing sections provides a condensed view of the playbook flow, reducing visual clutter and enabling quick access to specific sections. Expanding sections allows you to view or edit specific parts of a playbook while keeping the rest of the playbook compact and maintaining focus on the relevant playbook details. You can also hover over a Section Header to highlight all tasks under the section and easily identify the section scope.
To collapse and expand a section, in the Playbooks page, after selecting a playbook from the library or creating a new playbook and adding tasks, click 
on a section header.
When you collapse a section, you can see the number of tasks included under the section. For example:
Click 
to collapse or expand the entire playbook.
