> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-inputs-and-outputs.md).

# Playbook Inputs and Outputs

Playbooks and tasks have inputs, which are data pieces that are present in the playbook or task. The inputs are often manipulated or enriched and they produce outputs. The inputs might come from the incident itself, such as the role to whom to assign the incident, or an input can be provided by an integration. For example, when an Active Directory integration is used in a task to extract a user's credentials.

You can add playbook inputs from context data and from indicators. Some playbooks such as [Threat Intel Management playbooks](/cortex-xsoar-8-on-prem/8.5/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-management-playbooks-to-process-indicators.md) use indicators as the playbook input.

The example below uses incident context data as the playbook input.

![playbook-inputs.png](/files/NPaZWgYuNx4VkKzJOAAE)

In the image above, we see a playbook that is triggered based on context data, meaning an incident. The first two inputs are the **`SrcIP`**, which comes from the **`incident.src`** key, and **`DstIP`**, which is retrieved from **`incident.dst`**.

In addition, the playbook itself creates an output object whose entries serve the tasks throughout the playbook.

![playbook-inpt-output.png](/files/DdXU0Oi25oj9tVTW6mah)

For example, we create a list of endpoint IP addresses which can later be enriched by an IP enrichment task, or a list of endpoint MAC addresses, which can be used to possibly get information about the hosts that were affected by the incident.

Outputs can also be data that was extracted or derived from the inputs. For example, in the following image we received the user's credentials from Active Directory, and used those credentials to retrieve the user's email address, manager, and any groups to which they belong.

![playbook-edit-task.png](/files/z2T5YQHIzEEE6WHm3go9)

An output can then serve as input for a subsequent task. For example, the user's manager who was returned as an output in the image above, can be used as an input to retrieve information from Active Directory.

![playbook-edit-task-man.png](/files/Tblvc4VEd4wuRY7eiMJ3)

Notice that the input for this task is Account.Manager, which is the output we highlighted in the playbooks inputs, above.

For information on giving sub-playbooks access to main playbook data, see [Incident Context Data](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-context-data.md).

**Task Cheat Sheet**

The task cheat sheet enables quick access to system and custom fields to populate playbook task inputs and outputs.

1. Click ![playbook-brackets.png](/files/zDj2WdqiwAY60KDDL681).

   The cheat sheet opens displaying incident fields.
2. Select an incident field, it populates the task input with the corresponding context key.

   ![playbook-task-cheat-sheet.png](/files/4M5bkZ2Pf9aRx1dXZw9t)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-inputs-and-outputs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.