Add sub-playbooks

Add sub-playbooks to reuse automation workflows.

Sub-playbooks are playbooks that are nested under other playbooks. They appear as tasks in the parent playbook flow and are indicated by the sub-playbook icon . A sub-playbook can also be a parent playbook in a different use case.

For example, IP Enrichment - Generic v2 and Retrieve File From Endpoint - Generic v3 playbooks are usually used as part of a bigger investigation.

Since sub-playbooks are building blocks that can be used in other playbooks and use cases, you should define generic inputs for them.

Inputs can be passed to sub-playbooks from the parent playbook, used and processed in the sub-playbook, and sent as output to the parent playbook.

To modify the settings or task configurations for system playbooks (out-of-the-box playbooks), your role must have the Edit Public Playbooks permission enabled. If this permission is not enabled, system playbooks will remain read-only. For more information, see Manage access to playbooks and scripts.

1. From the Task Library pane, click Playbooks.
2. Find the relevant sub-playbook by either searching for a specific playbook by name in your Org repository from the Org Playbooks tab, or by adopting a playbook from the Playbooks catalog tab.

   You can sort alphabetically (ABC) or by Last Modified.
3. Hover over the playbook you want and drag it onto the playbook editor.

   When you adopt a playbook from the Playbooks Catalog, installation may take some time.

   When you adopt a system playbook, it is locked and you can only make limited changes to the playbook settings from the Playbook Starts task. For full editing capabilities, click and select either Duplicate (create a copy of the playbook to edit) or Edit Playbook (detach the playbook). A detached playbook does not receive updates in future content releases. If you reattach the playbook, the latest content updates will be applied and any edits you made will be overridden.

   1. If after adopting a playbook you see a warning indicating the sub-playbook is not ready to use, click the playbook to open its Task Details pane.
   2. In the error message, click the Open it link to view the sub-playbook in a new tab in the playbook editor.
   3. Scroll through the sub-playbook. If there is a task that requires integration setup, click the task to open the Task Details pane and click the Create an instance now link.
   4. In the integration instance settings pane, enter values for the settings fields.
   5. Click Save & Exit for the integration instance.
4. Configure the sub-playbook.

   1. In your main playbook editor, click the sub-playbook you added. The Task Details pane opens.
   2. Click the Open sub-playbook link to open the sub-playbook in a new tab. You can then view and edit the tasks in the sub-playbook.
   3. Click the curly brackets next to the sub-playbook name to select the data source for the sub-playbook.
   4. Configure the sub-playbook settings from the following tabs.

      Tab	Settings
      Inputs	Any required input arguments for the sub-playbook.
      Outputs	Any outputs defined for the sub-playbook.
      Advanced	Register as case timeline record: If enabled, the results of the sub-playbook task execution appear as a record in the case timeline. If enabled, you must enter a Record name. You have the option of adding an Effective time, Description, Tags, and marking the record as evidence and adding an evidence comment. NOTE: Only enter an Effective time if you want the same exact time recorded every time the sub-playbook task executes. Skip this branch if this script/playbook is unavailable Quiet Mode: Determines whether this task uses the playbook default setting for quiet mode. When in quiet mode, tasks do not display inputs and outputs or extract indicators. Errors and warnings are still documented. You can turn quiet mode on or off at the task or playbook level.
      Loop	Click one of the following options to define loop settings: None: (Default) The sub-playbook does not loop. Built-in: Use built-in functions to define loop settings. Exit when: Defines when to exit the loop. Click {} and expand the source category. Hover over the required source, then click Filter & Transform to manipulate the data. Equals (String): Select the operator that evaluates the values. Max iterations: Defines how many times the loop runs. Balance iterations and intervals to avoid overloading the server. Sleep: Defines the seconds between iterations. Balance iterations and wait time to avoid overloading the server. For each input: Runs the sub-playbook based on defined inputs. Enter the number of seconds to wait between iterations. Choose Loop automation: Select the automation from the drop-down list to define when to exit the loop. The parameters that appear are applicable to the selected automation. For more information, see Configure a sub-playbook loop.
      Details	Task description (Markdown supported): Displays a description for this playbook (if one exists).

5. Select whether the outputs of the sub-playbook are Shared globally or Private to sub-playbook (default).
6. Click OK.
7. Connect the sub-playbook you've added by dragging and dropping a wire.