> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook.md).

# Build your playbook

Build a playbook by configuring tasks, logic, and settings.

Depending on your use case, you can use or customize a system playbook or develop a new playbook from scratch.

Developing a new playbook from scratch enables a tailored solution for your use case, whereas customizing a system playbook can save time, reduce complexity, and be a more efficient way to meet your organization's specific security and issue response needs.

{% hint style="info" %}

### Important

The ability to create, edit, or share custom playbooks is governed by access management. If certain options are unavailable, contact your administrator. For more information, see [Manage access to playbooks and scripts](/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-playbooks-and-scripts.md).
{% endhint %}

Follow these steps to build a playbook.

| Task                                                      | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | See More                                                                                                                                                                                                                           |
| --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Task 1. Choose from existing playbooks or create your own | <p>Search for an out-of-the-box playbook to use, customize it, or create one based on your use case.</p><p>Use the AI-powered Agentic Playbook Builder (preview) to simplify playbook creation and management through an intuitive, interactive experience. </p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>The Agentic Playbook Builder preview feature is not enabled by default. To request access, contact <a href="mailto:dl-CortexAgentixDesignPartners@paloaltonetworks.com">Cortex Product Management</a>.</p></div> | See [Choose from existing playbooks or create your own](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/choose-from-existing-playbooks-or-create-your-own.md). |
| Task 2. Configure playbook settings                       | Define playbook settings, such as playbook triggers, inputs and outputs, and general settings.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | See [Configure playbook settings](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-playbook-settings.md).                                             |
| Task 3. Add objects from the Task Library                 | The **Task Library** contains AI prompts, scripts, sub-playbooks, and tasks that enable you to communicate with end users, set conditions, and store relevant data.                                                                                                                                                                                                                                                                                                                                                                                                                 | See [Add objects from the Task Library](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library.md).                                 |
| Task 4. Customize your playbook                           | Add scripts and sub-playbook loops, filter and transform data, extract indicators, extend context, create issue fields, poll, and more.                                                                                                                                                                                                                                                                                                                                                                                                                                             | See [Customize your playbook](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook.md).                                                     |
| Task 5. Test your playbook                                | Set breakpoints, conditional breakpoints, skip tasks, and input and output overrides in the playbook debugger.                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | See [Test your playbook](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook.md).                                                               |
| Task 6. Manage playbook content                           | Save versions of your playbook.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | See [Manage playbook content](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/manage-playbook-content.md).                                                     |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.