Playbooks overview

Learn how playbooks automate investigation and response workflows in Cortex AgentiX.

Cortex AgentiX playbooks are visual canvases that automate security response workflows. They orchestrate actions across products, manage case data, and interact with users. This provides a consistent and rapid response to security events.

One-stop playbook development

Before you build a playbook, review your organization's playbook list on the Playbooks page. The Playbook Catalog contains available out-of-the-box playbooks that are not yet in use. You can adopt a catalog playbook or develop one from scratch. The playbook editor supports the complete development flow. You can create and edit tasks, configure automation rules, and set up integrations.

Task Library

The Task Library in the playbook editor contains objects you can add to a playbook. You can create tasks from scripts, repurpose existing tasks, and use playbooks as sub-playbooks.

Playbook tasks display unique logos. These identify task type and origin, such as third-party integration commands, built-in scripts, and manual-input tasks.

Task Library Object	Action	See More
AI Prompts	Add AI prompts with inputs and outputs that run automatically.	See Add AI Prompt tasks.
Commands & Scripts	Add commands and scripts from installed integrations. Configure instances as needed.	See Add commands and scripts.
Playbooks	Add sub-playbooks from your Org repository or the Playbooks Catalog.	See Add sub-playbooks.
Manual Tasks	Add tasks from playbooks in your Org repository.	See Add manual tasks and blank tasks.
Header	Add section headers to organize your playbook.	See Create a section header.
Blank Task	Create a new task from scratch.	See Add manual tasks and blank tasks.

Post-development playbook testing

After developing the playbook, including its automation rules, run the debugger for initial testing.

After confirming the playbook runs correctly with issues, you can use it in production.

To see which playbook ran for an issue, go to Cases & Issues → Issues. Scroll to the Playbook column. Select an issue, then select the Work Plan tab to view or change its playbook.

To see whether a playbook ran in a case, go to Cases & Issues → Cases. Check the Automation section of the case Overview tab. To view or change the playbook, select an issue in Issues & Insights, then select Work Plan.

For more information, see Analyze and resolve cases.