> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/manage-playbooks.md). # Manage playbooks Create, organize, enable, and maintain Cortex XSIAM playbooks. The **Playbooks** page is organized to help you easily access and utilize playbooks specific to your use cases. It contains two main sections: key playbook details at the top and a table listing all the playbooks in your Org repository at the bottom. ### Monitor Cortex XSIAM playbook status Playbook statuses track the progress of automation tasks and identify any issues or delays. If needed, you can then take corrective actions to ensure smooth workflow execution and operational efficiency. The status includes how many playbooks: * Are in your Org repository * Are enabled * Are active * Are using an automation rule * Are used as sub-playbooks * Ran in the past week ### Manage playbooks in the Cortex XSIAM Org repository The playbooks listed in the Org repository table have been either adopted by or built by your organization. The table shows high-level details about the playbooks, including: * Playbook name * Description * Status * Source * Whether the playbook is Autonomous * Enabled and disabled automation rules associated with the playbook * How many playbooks it serves as a sub-playbook in * Last updated * Updated by * The content pack the playbook is a part of * Playbook tags When you right-click a specific playbook, you can choose to open it in the editor, duplicate, disable, download, or remove it. Playbooks in your **Org Playbooks** can be triggered to run by automation rules, jobs, or can be manually run on one or more issues. Playbooks that you adopted are part of content packs. When a playbook is adopted, the content pack for that playbook is downloaded and appears in Marketplace. If you remove a playbook from your Org Playbooks, the content pack remains installed, but the playbook is no longer available for automation rules or manual runs. ### Find and adopt Cortex XSIAM playbooks from the Playbook Catalog The **Playbook Catalog** contains all the playbooks available in Marketplace, organized by cards. You can search for specific playbooks in the **Search by** filter according to the following criteria: * **Everywhere (default)**: Searches for the specified keyword across all fields, including the playbook name, description, and tags. * **Name**: Limits the search to the playbook title. * **Description**: Searches within the playbook's detailed description for matching terms. * **Tag**: Filters playbooks by specific metadata tags assigned to them. * **Content pack**: Filters the catalog to show only playbooks that belong to a specific content pack. Clicking a playbook card provides a preview of the playbook. If it is relevant for your use case, click **Adopt this playbook** to bring it into your Org repository and make it available to run. {% hint style="info" %} * The library by default shows only playbooks that are not adopted. Click the **Show Adopted** checkbox to show the adopted playbooks, indicated by an **Adopted** mark. * The library shows the most updated playbook version. Adopting an older version than shown should be done through Marketplace. * Adopting a playbook does not make it run. Some content packs include recommended automation rules. When you configure automation rules, you can view the recommendations. See [Create an automation rule](/cortex-xsiam/configure-cortex-xsiam/automations/create-an-automation-rule.md). {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/manage-playbooks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.