> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/playbooks-overview.md). # Playbooks overview Cortex XSIAM playbooks are visual canvases that allow you to automate your security response workflows. They can orchestrate actions across different products, manage case data, and interact with users to ensure a consistent and rapid response to security events. **One-stop playbook development** Before you start building your playbook, go to the **Playbooks** page and review the Org playbook list, which are playbooks that are currently used in your organization. On the **Playbook Catalog** page, you can find available out-of the-box playbooks that are not in use in your organization which you can adopt and use. If an existing playbook does not meet your use case, you can develop a playbook from scratch. Whether editing an existing playbook or creating a new one, you can manage the entire automation development flow in the playbook editor, including creating and editing tasks, configuring automation rules to trigger your playbooks, and setting up all relevant integrations. **Task Library** The **Task Library** in the playbook editor contains the following objects you can add to your playbook. For example, you can create new tasks from scripts, repurpose existing tasks, and use existing playbooks as sub-playbooks. Playbook tasks display unique logos to more easily identify task type and origin, for example third-party integration commands, built-in scripts and tasks, and tasks requiring manual inputs. | Task Library Object | Action | See More | | ---------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **AI Prompts** | Add AI prompts with inputs and outputs that run automatically. | See [Add AI Prompt tasks](/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-ai-prompt-tasks.md). | | **Commands & Scripts** | Add commands and scripts from integrations that you install and configure instances for as needed. | See [Add commands and scripts](/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-commands-and-scripts.md). | | **Playbooks** | Add sub-playbooks to your playbook from your Org repository or from the Playbooks Catalog. | See [Add sub-playbooks](/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-sub-playbooks.md). | | **Manual Tasks** | Add tasks from playbooks in your Org repository. | See [Add manual tasks and blank tasks](/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md). | | **Header** | Add section headers to organize your playbook. | See [Create a section header](/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/create-a-section-header.md). | | **Blank Task** | Create a new task from scratch. | See [Add manual tasks and blank tasks](/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md). | **Post-development playbook testing** After developing the playbook (including setting automation rules to trigger the playbook), run the debugger to initially test the playbook. Once you confirm the playbook runs without errors, start ingesting issues to check that the playbook runs properly with data. The automation rule you defined for the playbook will trigger it to run when a relevant issue is ingested into Cortex XSIAM. After verifying the playbook is triggered and runs properly with issues, it is ready to use in production. You can see which playbook ran for an issue by going to **Cases & Issues**, selecting **Issues** and scrolling to the **Playbook** column. You can view or update the playbook by selecting an issue and clicking the **Work Plan** tab. Select another playbook to run from the dropdown list. You can see which playbook ran in a case, if any, by going to **Cases & Issues**, selecting **Cases** and looking at the **Automation** section in the **Overview** tab for the case. You can view or update the playbook by going to the **Issues & Insights** tab, selecting an issue, and then clicking the **Work Plan** tab. In the **Work Plan**, you can select another playbook to run from the dropdown list. For more information, see [Analyze and resolve cases](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/playbooks-overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.