Playbooks

APIs for managing playbooks

Get a playbook

post

Get a playbook by filtering based on its name or ID. The playbook's YAML is returned in a ZIP file.

Requires the granular RBAC permission for this feature.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

Responses

200

OK

post/public_api/v1/playbooks/get

POST /public_api/v1/playbooks/get HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 71

{
  "request_data": {
    "filter": {
      "field": "name",
      "value": "Phishingplaybook"
    }
  }
}

200

OK

No content

Insert or update playbooks

post

Add or update a playbook by passing the YAML in a ZIP file.

Requires the granular RBAC permission for this feature.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

filestring · binaryOptional

Responses

200

OK

application/json

objects_countintegerOptional

The number of playbooks identified and attempted to be added.

post/public_api/v1/playbooks/insert

POST /public_api/v1/playbooks/insert HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: multipart/form-data
Accept: */*
Content-Length: 17

{
  "file": "binary"
}

200

OK

{
  "objects_count": 1,
  "objects": {
    "failures_items": [
      {
        "error": "text",
        "id": "text"
      }
    ]
  }
}

Delete a playbook

post

Delete a playbook by filtering based on its name or ID.

Requires the granular RBAC permission for this feature.

Header parameters

AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

Responses

200

OK

application/json

objects_countintegerOptional

The number of playbooks identified and attempted to be deleted.

post/public_api/v1/playbooks/delete

POST /public_api/v1/playbooks/delete HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 71

{
  "request_data": {
    "filter": {
      "field": "name",
      "value": "Phishingplaybook"
    }
  }
}

200

OK

{
  "objects_count": 1,
  "objects": {
    "failures_items": [
      {
        "error": "text",
        "id": "text"
      }
    ],
    "succeeded_items": [
      {
        "id": "text"
      }
    ]
  }
}