Manage playbooks

Create, organize, enable, and maintain Cortex XSIAM playbooks.

The Playbooks page is organized to help you easily access and utilize playbooks specific to your use cases. It contains two main sections: key playbook details at the top and a table listing all the playbooks in your Org repository at the bottom.

Monitor Cortex XSIAM playbook status

Playbook statuses track the progress of automation tasks and identify any issues or delays. If needed, you can then take corrective actions to ensure smooth workflow execution and operational efficiency. The status includes how many playbooks:

• Are in your Org repository
• Are enabled
• Are active
• Are using an automation rule
• Are used as sub-playbooks
• Ran in the past week

Manage playbooks in the Cortex XSIAM Org repository

The playbooks listed in the Org repository table have been either adopted by or built by your organization. The table shows high-level details about the playbooks, including:

• Playbook name
• Description
• Status
• Source
• Whether the playbook is Autonomous
• Enabled and disabled automation rules associated with the playbook
• How many playbooks it serves as a sub-playbook in
• Last updated
• Updated by
• The content pack the playbook is a part of
• Playbook tags

When you right-click a specific playbook, you can choose to open it in the editor, duplicate, disable, download, or remove it.

Playbooks in your Org Playbooks can be triggered to run by automation rules, jobs, or can be manually run on one or more issues.

Playbooks that you adopted are part of content packs. When a playbook is adopted, the content pack for that playbook is downloaded and appears in Marketplace. If you remove a playbook from your Org Playbooks, the content pack remains installed, but the playbook is no longer available for automation rules or manual runs.

Find and adopt Cortex XSIAM playbooks from the Playbook Catalog

The Playbook Catalog contains all the playbooks available in Marketplace, organized by cards.

You can search for specific playbooks in the Search by filter according to the following criteria:

• Everywhere (default): Searches for the specified keyword across all fields, including the playbook name, description, and tags.
• Name: Limits the search to the playbook title.
• Description: Searches within the playbook's detailed description for matching terms.
• Tag: Filters playbooks by specific metadata tags assigned to them.
• Content pack: Filters the catalog to show only playbooks that belong to a specific content pack.

Clicking a playbook card provides a preview of the playbook. If it is relevant for your use case, click Adopt this playbook to bring it into your Org repository and make it available to run.

• The library by default shows only playbooks that are not adopted. Click the Show Adopted checkbox to show the adopted playbooks, indicated by an Adopted mark.
• The library shows the most updated playbook version. Adopting an older version than shown should be done through Marketplace.
• Adopting a playbook does not make it run. Some content packs include recommended automation rules. When you configure automation rules, you can view the recommendations. See Create an automation rule.