Plan your playbook

Plan automated security workflows before building a playbook in Cortex AgentiX.

When defining your playbook workflow, consider these questions:

• Which processes need automation?
• Which decisions need manual intervention?
• Does automation require dynamic decisions or complex data interpretation?
• Which parts of the workflow are time-sensitive?
• When is the case considered remediated?

Example: Review the phishing use case

Review the phishing workflow below. You can also review playbooks in the Phishing content pack.

• Detection
• Identification
• Analysis
• Remediation

Each high-level process can contain several sub-processes. You can automate these actions with customized or new playbooks.