Playbooks
APIs for managing playbooks
Mark a playbook task as completed.
Investigation ID
File name
Comment about the file
Task ID
Task input
OK
InvestigationPlaybook is a wrapper for a linked list of Playbook tasks
Indicate whether this playbook has new history during this session
Who has created this event - relevant only for manual incidents
Internal field to make queries on role faster
Incident create date
Do not change this field manually
The role assigned to this investigation
Holds the ID of the responsible cluster app server
FirstTask is the root task of the playbook
InvestigationPlaybookState indicates the state of the running playbook
PlaybookView represents the view in client of playbook graph
POST /xsoar/public/v1/inv-playbook/task/complete HTTP/1.1
Host: api-yourfqdn
Content-Type: multipart/form-data
Accept: */*
Content-Length: 100
{
"investigationId": "text",
"fileName": "text",
"fileComment": "text",
"taskId": "text",
"taskInput": "text"
}OK
{
"Dirty": true,
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"ReplacedPlaybook": true,
"ShardID": 1,
"UpdatedOperatorIDs": true,
"allRead": true,
"allReadWrite": true,
"autoExtracting": true,
"cacheVersn": 1,
"comment": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentCreateDate": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"inputs": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
],
"invPBDebugInfo": {
"originalInvPBId": "text"
},
"investigationId": "text",
"isTIM": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pbHistory": [
{
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"autoExtracting": true,
"comment": "text",
"inputs": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
],
"investigationId": "text",
"isTIM": true,
"name": "text",
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"quiet": true,
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
]
},
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"tasks": {
"ANY_ADDITIONAL_PROPERTY": {
"Reopen": true,
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"assignee": "text",
"assigneeSet": true,
"blockingTasks": [
"text"
],
"calculatedDescription": "text",
"calculatedTaskName": "text",
"comments": true,
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"conditions": [
"[Circular Reference]"
],
"continueOnError": true,
"continueOnErrorType": "text",
"defaultAssignee": "text",
"defaultAssigneeComplex": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
},
"defaultReminder": 1,
"doNotSaveTaskHistory": true,
"dueDate": "2026-01-01T00:00:00.000Z",
"dueDateDuration": 1,
"dueDateDurationUnit": 1,
"dueDateSet": true,
"entries": [
"text"
],
"evidenceData": {
"customFields": "[Circular Reference]",
"description": "[Circular Reference]",
"occurred": "[Circular Reference]",
"tags": "[Circular Reference]"
},
"executionCount": 1,
"externalFormUseAuth": true,
"fieldMapping": [
"[Circular Reference]"
],
"forEachIndex": 1,
"forEachInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{}
]
},
"form": {
"description": "text",
"expired": true,
"questions": "[Circular Reference]",
"sender": "text",
"title": "text",
"totalAnswers": 1
},
"formDisplay": {
"bodyBackgroundColor": "text",
"bodyFontColor": "text",
"headerBackgroundColor": "text",
"headerFontColor": "text",
"isExternalRtl": true,
"sender": "text",
"submitButtonBackgroundColor": "text",
"submitButtonFontColor": "text",
"submitText": "text"
},
"hasErrorEntries": true,
"id": "text",
"ignoreWorker": true,
"indent": 1,
"input": "text",
"isAutoSwitchedToQuietMode": true,
"isOverSize": true,
"loop": {
"brand": "text",
"builtinCondition": "[Circular Reference]",
"exitCondition": "text",
"forEach": true,
"isCommand": true,
"max": 1,
"scriptArguments": "[Circular Reference]",
"scriptId": "text",
"scriptName": "text",
"wait": 1
},
"message": {
"bcc": "[Circular Reference]",
"body": "[Circular Reference]",
"cc": "[Circular Reference]",
"defaultOption": "text",
"format": "text",
"methods": [
"text"
],
"replyOptions": [
"text"
],
"subject": "[Circular Reference]",
"timings": {
"completeAfterReplies": 1,
"completeAfterSLA": true,
"completeAfterV2": true,
"retriesCount": 1,
"retriesInterval": 1
},
"to": "[Circular Reference]"
},
"missingContentItem": "text",
"nextPollingTime": "2026-01-01T00:00:00.000Z",
"nextTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"note": true,
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"parentBlockCount": 1,
"parentPlaybookID": "text",
"patched": true,
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingEntries": [
"text"
],
"pollingTimeoutTime": "2026-01-01T00:00:00.000Z",
"previousTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"quietMode": 1,
"reminder": 1,
"reputationCalc": 1,
"restrictedCompletion": true,
"scriptArguments": {
"ANY_ADDITIONAL_PROPERTY": "[Circular Reference]"
},
"separateContext": true,
"skip": true,
"skipUnavailable": true,
"sla": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"slaReminder": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"startDate": "2026-01-01T00:00:00.000Z",
"startedExecutingHarmfulScript": true,
"state": "text",
"subPlaybook": {
"Dirty": true,
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"ReplacedPlaybook": true,
"ShardID": 1,
"UpdatedOperatorIDs": true,
"allRead": true,
"allReadWrite": true,
"autoExtracting": true,
"cacheVersn": 1,
"comment": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentCreateDate": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"inputs": "[Circular Reference]",
"invPBDebugInfo": {
"originalInvPBId": "text"
},
"investigationId": "text",
"isTIM": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pbHistory": "[Circular Reference]",
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"quiet": true,
"recoveryAttempts": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"serverId": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": "[Circular Reference]",
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"syncHash": "text",
"tasks": "[Circular Reference]",
"version": 1,
"view": {},
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
},
"task": {
"brand": "text",
"cacheVersn": 1,
"clonedFrom": "text",
"comment": "text",
"conditions": [
"text"
],
"created": "2026-01-01T00:00:00.000Z",
"description": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"isCommand": true,
"isLocked": true,
"isTitleTask": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"playbookId": "text",
"playbookName": "text",
"primaryTerm": 1,
"scriptId": "text",
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"tags": [
"text"
],
"type": "text",
"version": 1
},
"taskCompleteData": [
{
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"calculatedDescription": "text",
"calculatedTaskName": "text",
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"entries": [
"text"
],
"hasErrorEntries": true,
"input": "text",
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"startDate": "2026-01-01T00:00:00.000Z",
"state": "text",
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
],
"taskDebug": {
"breakpointCondition": "[Circular Reference]",
"inputOverrides": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"isMarkedWithBreakpoint": true,
"isMarkedWithSkip": true,
"outputOverrides": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"shouldOverrideDebugInfo": true,
"skipConditionOverrideTo": "text",
"taskOriginalId": "text"
},
"taskId": "text",
"taskSize": 1,
"timerTriggers": [
{
"action": "text",
"fieldName": "text"
}
],
"timesPolled": 1,
"type": "text",
"view": {},
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
},
"view": {}
}
],
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"quiet": true,
"recoveryAttempts": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"serverId": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
]
},
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"syncHash": "text",
"tasks": {
"ANY_ADDITIONAL_PROPERTY": {
"Reopen": true,
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"assignee": "text",
"assigneeSet": true,
"blockingTasks": [
"text"
],
"calculatedDescription": "text",
"calculatedTaskName": "text",
"comments": true,
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"conditions": [
{
"condition": [
"[Circular Reference]"
],
"label": "text"
}
],
"continueOnError": true,
"continueOnErrorType": "text",
"defaultAssignee": "text",
"defaultAssigneeComplex": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
},
"defaultReminder": 1,
"doNotSaveTaskHistory": true,
"dueDate": "2026-01-01T00:00:00.000Z",
"dueDateDuration": 1,
"dueDateDurationUnit": 1,
"dueDateSet": true,
"entries": [
"text"
],
"evidenceData": {
"customFields": "[Circular Reference]",
"description": "[Circular Reference]",
"occurred": "[Circular Reference]",
"tags": "[Circular Reference]"
},
"executionCount": 1,
"externalFormUseAuth": true,
"fieldMapping": [
{
"fieldId": "text",
"output": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
}
}
],
"forEachIndex": 1,
"forEachInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{}
]
},
"form": {
"description": "text",
"expired": true,
"questions": "[Circular Reference]",
"sender": "text",
"title": "text",
"totalAnswers": 1
},
"formDisplay": {
"bodyBackgroundColor": "text",
"bodyFontColor": "text",
"headerBackgroundColor": "text",
"headerFontColor": "text",
"isExternalRtl": true,
"sender": "text",
"submitButtonBackgroundColor": "text",
"submitButtonFontColor": "text",
"submitText": "text"
},
"hasErrorEntries": true,
"id": "text",
"ignoreWorker": true,
"indent": 1,
"input": "text",
"isAutoSwitchedToQuietMode": true,
"isOverSize": true,
"loop": {
"brand": "text",
"builtinCondition": "[Circular Reference]",
"exitCondition": "text",
"forEach": true,
"isCommand": true,
"max": 1,
"scriptArguments": "[Circular Reference]",
"scriptId": "text",
"scriptName": "text",
"wait": 1
},
"message": {
"bcc": "[Circular Reference]",
"body": "[Circular Reference]",
"cc": "[Circular Reference]",
"defaultOption": "text",
"format": "text",
"methods": [
"text"
],
"replyOptions": [
"text"
],
"subject": "[Circular Reference]",
"timings": {
"completeAfterReplies": 1,
"completeAfterSLA": true,
"completeAfterV2": true,
"retriesCount": 1,
"retriesInterval": 1
},
"to": "[Circular Reference]"
},
"missingContentItem": "text",
"nextPollingTime": "2026-01-01T00:00:00.000Z",
"nextTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"note": true,
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"parentBlockCount": 1,
"parentPlaybookID": "text",
"patched": true,
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingEntries": [
"text"
],
"pollingTimeoutTime": "2026-01-01T00:00:00.000Z",
"previousTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"quietMode": 1,
"reminder": 1,
"reputationCalc": 1,
"restrictedCompletion": true,
"scriptArguments": {
"ANY_ADDITIONAL_PROPERTY": "[Circular Reference]"
},
"separateContext": true,
"skip": true,
"skipUnavailable": true,
"sla": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"slaReminder": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"startDate": "2026-01-01T00:00:00.000Z",
"startedExecutingHarmfulScript": true,
"state": "text",
"subPlaybook": {
"Dirty": true,
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"ReplacedPlaybook": true,
"ShardID": 1,
"UpdatedOperatorIDs": true,
"allRead": true,
"allReadWrite": true,
"autoExtracting": true,
"cacheVersn": 1,
"comment": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentCreateDate": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"inputs": "[Circular Reference]",
"invPBDebugInfo": {
"originalInvPBId": "text"
},
"investigationId": "text",
"isTIM": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pbHistory": "[Circular Reference]",
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"quiet": true,
"recoveryAttempts": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"serverId": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": "[Circular Reference]",
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"syncHash": "text",
"tasks": "[Circular Reference]",
"version": 1,
"view": {},
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
},
"task": {
"brand": "text",
"cacheVersn": 1,
"clonedFrom": "text",
"comment": "text",
"conditions": [
"text"
],
"created": "2026-01-01T00:00:00.000Z",
"description": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"isCommand": true,
"isLocked": true,
"isTitleTask": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"playbookId": "text",
"playbookName": "text",
"primaryTerm": 1,
"scriptId": "text",
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"tags": [
"text"
],
"type": "text",
"version": 1
},
"taskCompleteData": [
{
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"calculatedDescription": "text",
"calculatedTaskName": "text",
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"entries": [
"text"
],
"hasErrorEntries": true,
"input": "text",
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"startDate": "2026-01-01T00:00:00.000Z",
"state": "text",
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
],
"taskDebug": {
"breakpointCondition": "[Circular Reference]",
"inputOverrides": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"isMarkedWithBreakpoint": true,
"isMarkedWithSkip": true,
"outputOverrides": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"shouldOverrideDebugInfo": true,
"skipConditionOverrideTo": "text",
"taskOriginalId": "text"
},
"taskId": "text",
"taskSize": 1,
"timerTriggers": [
{
"action": "text",
"fieldName": "text"
}
],
"timesPolled": 1,
"type": "text",
"view": {},
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
},
"version": 1,
"view": {},
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}Trigger execution of automatic task in running investigation.
OK
POST /xsoar/public/v1/inv-playbook/task/execute HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 142
{
"taskinfo": {
"invId": "162204",
"inTaskID": "2",
"version": 5,
"args": {
"value": {
"simple": "rocket_Bo6n7sZi"
}
},
"loopArgs": {}
},
"playbooksdebuginfo": {}
}OK
{
"id": "162204",
"version": 6,
"cacheVersn": 0,
"modified": "2024-02-29T15:51:56.27584538Z",
"sizeInBytes": 0,
"dbotCreatedBy": "rocket-auto-instance-admin@panw.com",
"incidentCreateDate": "2024-02-29T15:51:34.041Z",
"name": "rocket_test_workplan_add_edit_playbook_task_7lrLJ0Jh",
"playbookId": "5752c903-8ea3-46dd-8777-19ada3372416",
"investigationId": "162204",
"startTaskId": "0",
"tasks": {
"0": {
"id": "0",
"taskId": "77e95ddf-979c-4b35-8032-1bd92d649a61",
"type": "start",
"task": {
"id": "77e95ddf-979c-4b35-8032-1bd92d649a61",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 70607475,
"primaryTerm": 12,
"modified": "2024-02-29T15:51:33.992522243Z",
"sizeInBytes": 174,
"description": "Vj2W0c",
"type": "regular"
},
"nextTasks": {
"#none#": [
"1"
]
},
"continueOnErrorType": "",
"view": {
"position": {
"x": 50,
"y": 250
}
},
"evidenceData": {},
"quietMode": 2,
"dueDate": "0001-01-01T00:00:00Z",
"completedBy": "DBot",
"startDate": "0001-01-01T00:00:00Z",
"completedDate": "2024-02-29T15:51:47.285963348Z",
"state": "Completed",
"hasErrorEntries": false,
"doNotSaveTaskHistory": true,
"Reopen": false,
"taskSize": 37
},
"1": {
"id": "1",
"taskId": "12e64c4e-2ba6-4ce0-8b1b-1d24cfe87d4a",
"type": "regular",
"task": {
"id": "12e64c4e-2ba6-4ce0-8b1b-1d24cfe87d4a",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 70607476,
"primaryTerm": 12,
"modified": "2024-02-29T15:51:34.054197062Z",
"sizeInBytes": 273,
"name": "IncreaseIncidentSeverity",
"description": "rocket_WtdijULj",
"scriptId": "IncreaseIncidentSeverity",
"type": "regular",
"brand": "builtin"
},
"nextTasks": {
"#none#": [
"2"
]
},
"scriptArguments": {
"severity": {
"simple": "MEDIUM"
}
},
"continueOnErrorType": "",
"view": {
"position": {
"x": 50,
"y": 430
}
},
"evidenceData": {},
"quietMode": 2,
"dueDate": "0001-01-01T00:00:00Z",
"previousTasks": {
"#none#": [
"0"
]
},
"completedBy": "rocket-auto-instance-admin@panw.com",
"startDate": "2024-02-29T15:51:49.204009306Z",
"completedDate": "2024-02-29T15:51:51.783791373Z",
"arguments": {
"severity": "MEDIUM"
},
"entries": [
"f43fa5e7-bc87-4590-8e01-18735d183d0d@162204"
],
"state": "Completed",
"hasErrorEntries": false,
"doNotSaveTaskHistory": true,
"Reopen": false,
"taskSize": 53
},
"2": {
"id": "2",
"taskId": "d05f2d76-bfee-4be3-8660-5f90d8529024",
"type": "regular",
"task": {
"id": "d05f2d76-bfee-4be3-8660-5f90d8529024",
"version": 0,
"cacheVersn": 0,
"modified": "0001-01-01T00:00:00Z",
"sizeInBytes": 0,
"name": "rocket_Bo6n7sZi",
"description": "rocket_BrqKsMmo",
"scriptId": "Print",
"type": "regular"
},
"scriptArguments": {
"value": {
"simple": "rocket_Bo6n7sZi"
}
},
"continueOnErrorType": "",
"view": {
"position": {
"x": 50,
"y": 430
}
},
"evidenceData": {},
"dueDate": "0001-01-01T00:00:00Z",
"previousTasks": {
"#none#": [
"1"
]
},
"patched": true,
"startDate": "2024-02-29T15:51:54.492185514Z",
"completedDate": "0001-01-01T00:00:00Z",
"hasErrorEntries": false,
"indent": 1,
"Reopen": false
}
},
"state": "inprogress",
"view": {
"linkLabelsPosition": {},
"paper": {
"dimensions": {
"height": 65,
"width": 380,
"x": 50,
"y": 50
}
}
},
"startDate": "2024-02-29T15:51:47.286026812Z",
"UpdatedOperatorIDs": true
}Reopen a closed task and change the status to not complete.
OK
POST /xsoar/public/v1/inv-playbook/task/uncomplete HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 503
{
"args": {
"ANY_ADDITIONAL_PROPERTY": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": [
{
"key": "text",
"value": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
}
}
],
"simple": "text"
}
},
"comment": "text",
"inTaskID": "text",
"input": "text",
"invId": "text"
}OK
No content
Get the playbook specified by playbook ID.
OK
GET /xsoar/public/v1/playbook/{playbook_id} HTTP/1.1
Host: api-yourfqdn
Accept: */*
OK
{
"id": "fdfa7738-7a5a-4036-84db-12db91f0e4d8",
"version": 2,
"cacheVersn": 0,
"sequenceNumber": 41433777,
"primaryTerm": 12,
"modified": "2024-02-21T10:23:03.804314283Z",
"sizeInBytes": 1079,
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"propagationLabels": [
"all"
],
"definitionId": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "test_123",
"nameRaw": "test_123",
"prevName": "test_123",
"startTaskId": "0",
"tasks": {
"0": {
"id": "0",
"taskId": "6b396031-b327-4de2-8dc2-30960a17f06d",
"type": "start",
"task": {
"id": "6b396031-b327-4de2-8dc2-30960a17f06d",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 41433768,
"primaryTerm": 12,
"modified": "2024-02-21T10:23:00.945714993Z",
"sizeInBytes": 134
},
"continueOnErrorType": "",
"view": {
"position": {
"x": 450,
"y": 50
}
},
"evidenceData": {}
}
},
"taskIds": [
"6b396031-b327-4de2-8dc2-30960a17f06d"
],
"scriptIds": [],
"commands": [],
"brands": [],
"view": {
"linkLabelsPosition": {},
"paper": {
"dimensions": {
"height": 65,
"width": 380,
"x": 450,
"y": 50
}
}
},
"inputs": null,
"outputs": null,
"quiet": true
}Search for playbooks using queries.
OK
POST /xsoar/public/v1/playbook/search HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 15
{
"query": "aaa"
}OK
{
"playbooks": [
{
"id": "8db0105c-f674-4d83-8095-f95a9f61e77a",
"version": 4,
"cacheVersn": 0,
"sequenceNumber": 33831652,
"primaryTerm": 11,
"modified": "2023-12-12T13:51:15.668021556Z",
"sizeInBytes": 0,
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"propagationLabels": [
"all"
],
"definitionId": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "aaa",
"nameRaw": "aaa",
"prevName": "aaa",
"startTaskId": "0",
"tasks": {
"0": {
"id": "0",
"taskId": "e228a044-2ad5-4ab0-873a-d5bb94a5c1b4",
"type": "start",
"task": {
"id": "e228a044-2ad5-4ab0-873a-d5bb94a5c1b4",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 13431901,
"primaryTerm": 8,
"modified": "2023-05-23T07:16:19.930125981Z",
"sizeInBytes": 0
},
"nextTasks": {
"#none#": [
"1"
]
},
"continueOnErrorType": "",
"view": {
"position": {
"x": 450,
"y": 50
}
},
"evidenceData": {}
},
"1": {
"id": "1",
"taskId": "c28b63d3-c860-4e16-82b4-6db6b58bdee3",
"type": "regular",
"task": {
"id": "c28b63d3-c860-4e16-82b4-6db6b58bdee3",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 33831651,
"primaryTerm": 11,
"modified": "2023-12-12T13:51:15.604271789Z",
"sizeInBytes": 0,
"name": "Untitled Task 1",
"description": "commands.local.cmd.set.incident",
"scriptId": "Builtin|||setIncident",
"type": "regular",
"isCommand": true,
"brand": "Builtin"
},
"scriptArguments": {
"severity": {
"simple": "1"
}
},
"continueOnErrorType": "",
"view": {
"position": {
"x": 450,
"y": 200
}
},
"evidenceData": {}
}
},
"taskIds": [
"e228a044-2ad5-4ab0-873a-d5bb94a5c1b4",
"c28b63d3-c860-4e16-82b4-6db6b58bdee3"
],
"scriptIds": [],
"commands": [
"setIncident"
],
"brands": [
"Builtin"
],
"missingScriptsIds": [
"Builtin|||setIncident"
],
"view": {
"linkLabelsPosition": {},
"paper": {
"dimensions": {
"height": 245,
"width": 380,
"x": 450,
"y": 50
}
}
},
"inputs": null,
"outputs": null,
"quiet": true
}
],
"tags": [
"Endpoint",
"ITDR",
"Automated",
"Phishing",
"Sandbox",
"Joe Security",
"Severity",
"Malware",
"Sumo Logic",
"Remediation",
"Job",
"Code42 Incydr",
"Sinkhole",
"XDR",
"TIM",
"PAN-OS",
"Vulnerability",
"Virus",
"Domaintools"
],
"total": 1
}Import and override an existing playbook by uploading its YAML file.
{api_key}
{api_key_id}
File
OK
POST /xsoar/public/v1/playbook/save/yaml HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: multipart/form-data
Accept: */*
Content-Length: 17
{
"file": "binary"
}OK
{
"playbook": {
"id": "690d9332-c937-48a7-8824-8e43d2b8f9a9",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 91021398,
"primaryTerm": 14,
"modified": "2025-04-27T11:42:56.923934719Z",
"sizeInBytes": 2065,
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"propagationLabels": [
"all"
],
"definitionId": "",
"isOverridable": false,
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "upload_playbook",
"nameRaw": "upload_playbook",
"prevName": "upload_playbook",
"startTaskId": "0",
"tasks": {
"0": {
"id": "0",
"taskId": "92acabef-2752-4a92-3781-d31bc823a8ec",
"type": "start",
"task": {
"id": "92acabef-2752-4a92-3781-d31bc823a8ec",
"version": 2,
"cacheVersn": 0,
"sequenceNumber": 91021396,
"primaryTerm": 14,
"modified": "2025-04-27T11:42:56.866094324Z",
"sizeInBytes": 179
},
"nextTasks": {
"#none#": [
"1"
]
},
"continueOnErrorType": "",
"view": {
"position": {
"x": 450,
"y": 50
}
},
"evidenceData": {}
},
"1": {
"id": "1",
"taskId": "f90c2695-c2ca-4819-3fa4-066d5971ac0d",
"type": "regular",
"task": {
"id": "f90c2695-c2ca-4819-3fa4-066d5971ac0d",
"version": 2,
"cacheVersn": 0,
"sequenceNumber": 91021397,
"primaryTerm": 14,
"modified": "2025-04-27T11:42:56.894923251Z",
"sizeInBytes": 340,
"name": "setIncident",
"description": "Change the properties of an incident",
"scriptId": "Builtin|||setIncident",
"type": "regular",
"isCommand": true,
"brand": "Builtin"
},
"scriptArguments": {
"accountid": {
"complex": {
"root": "incident",
"filters": null,
"accessor": "name",
"transformers": [
{
"operator": "concat",
"args": {
"prefix": {
"isContext": false
},
"suffix": {
"value": {
"simple": "upload_playbook_via_public_api"
},
"isContext": false
}
}
}
]
}
}
},
"continueOnErrorType": "",
"view": {
"position": {
"x": 450,
"y": 230
}
},
"evidenceData": {}
}
},
"taskIds": [
"92acabef-2752-4a92-3781-d31bc823a8ec",
"f90c2695-c2ca-4819-3fa4-066d5971ac0d"
],
"scriptIds": [],
"commands": [
"setIncident"
],
"brands": [
"Builtin"
],
"view": {
"linkLabelsPosition": {},
"paper": {
"dimensions": {
"height": 275,
"width": 380,
"x": 450,
"y": 50
}
}
},
"inputs": [],
"outputs": [],
"dirtyInputs": true
},
"warnings": null
}Add an ad-hoc task to a running playbook.
{api_key}
{api_key_id}
InvestigationPlaybook is a wrapper for a linked list of Playbook tasks
Indicate whether this playbook has new history during this session
Who has created this event - relevant only for manual incidents
Internal field to make queries on role faster
Incident create date
Do not change this field manually
The role assigned to this investigation
Holds the ID of the responsible cluster app server
FirstTask is the root task of the playbook
InvestigationPlaybookState indicates the state of the running playbook
PlaybookView represents the view in client of playbook graph
OK
InvestigationPlaybook is a wrapper for a linked list of Playbook tasks
Indicate whether this playbook has new history during this session
Who has created this event - relevant only for manual incidents
Internal field to make queries on role faster
Incident create date
Do not change this field manually
The role assigned to this investigation
Holds the ID of the responsible cluster app server
FirstTask is the root task of the playbook
InvestigationPlaybookState indicates the state of the running playbook
PlaybookView represents the view in client of playbook graph
POST /xsoar/public/v1/inv-playbook/task/add/{investigationId} HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 16609
{
"Dirty": true,
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"ReplacedPlaybook": true,
"ShardID": 1,
"UpdatedOperatorIDs": true,
"allRead": true,
"allReadWrite": true,
"autoExtracting": true,
"cacheVersn": 1,
"comment": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentCreateDate": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"inputs": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
],
"invPBDebugInfo": {
"originalInvPBId": "text"
},
"investigationId": "text",
"isTIM": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pbHistory": [
{
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"autoExtracting": true,
"comment": "text",
"inputs": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
],
"investigationId": "text",
"isTIM": true,
"name": "text",
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"quiet": true,
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
]
},
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"tasks": {
"ANY_ADDITIONAL_PROPERTY": {
"Reopen": true,
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"assignee": "text",
"assigneeSet": true,
"blockingTasks": [
"text"
],
"calculatedDescription": "text",
"calculatedTaskName": "text",
"comments": true,
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"conditions": [
"[Circular Reference]"
],
"continueOnError": true,
"continueOnErrorType": "text",
"defaultAssignee": "text",
"defaultAssigneeComplex": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
},
"defaultReminder": 1,
"doNotSaveTaskHistory": true,
"dueDate": "2026-01-01T00:00:00.000Z",
"dueDateDuration": 1,
"dueDateDurationUnit": 1,
"dueDateSet": true,
"entries": [
"text"
],
"evidenceData": {
"customFields": "[Circular Reference]",
"description": "[Circular Reference]",
"occurred": "[Circular Reference]",
"tags": "[Circular Reference]"
},
"executionCount": 1,
"externalFormUseAuth": true,
"fieldMapping": [
"[Circular Reference]"
],
"forEachIndex": 1,
"forEachInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{}
]
},
"form": {
"description": "text",
"expired": true,
"questions": "[Circular Reference]",
"sender": "text",
"title": "text",
"totalAnswers": 1
},
"formDisplay": {
"bodyBackgroundColor": "text",
"bodyFontColor": "text",
"headerBackgroundColor": "text",
"headerFontColor": "text",
"isExternalRtl": true,
"sender": "text",
"submitButtonBackgroundColor": "text",
"submitButtonFontColor": "text",
"submitText": "text"
},
"hasErrorEntries": true,
"id": "text",
"ignoreWorker": true,
"indent": 1,
"input": "text",
"isAutoSwitchedToQuietMode": true,
"isOverSize": true,
"loop": {
"brand": "text",
"builtinCondition": "[Circular Reference]",
"exitCondition": "text",
"forEach": true,
"isCommand": true,
"max": 1,
"scriptArguments": "[Circular Reference]",
"scriptId": "text",
"scriptName": "text",
"wait": 1
},
"message": {
"bcc": "[Circular Reference]",
"body": "[Circular Reference]",
"cc": "[Circular Reference]",
"defaultOption": "text",
"format": "text",
"methods": [
"text"
],
"replyOptions": [
"text"
],
"subject": "[Circular Reference]",
"timings": {
"completeAfterReplies": 1,
"completeAfterSLA": true,
"completeAfterV2": true,
"retriesCount": 1,
"retriesInterval": 1
},
"to": "[Circular Reference]"
},
"missingContentItem": "text",
"nextPollingTime": "2026-01-01T00:00:00.000Z",
"nextTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"note": true,
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"parentBlockCount": 1,
"parentPlaybookID": "text",
"patched": true,
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingEntries": [
"text"
],
"pollingTimeoutTime": "2026-01-01T00:00:00.000Z",
"previousTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"quietMode": 1,
"reminder": 1,
"reputationCalc": 1,
"restrictedCompletion": true,
"scriptArguments": {
"ANY_ADDITIONAL_PROPERTY": "[Circular Reference]"
},
"separateContext": true,
"skip": true,
"skipUnavailable": true,
"sla": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"slaReminder": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"startDate": "2026-01-01T00:00:00.000Z",
"startedExecutingHarmfulScript": true,
"state": "text",
"subPlaybook": {
"Dirty": true,
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"ReplacedPlaybook": true,
"ShardID": 1,
"UpdatedOperatorIDs": true,
"allRead": true,
"allReadWrite": true,
"autoExtracting": true,
"cacheVersn": 1,
"comment": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentCreateDate": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"inputs": "[Circular Reference]",
"invPBDebugInfo": {
"originalInvPBId": "text"
},
"investigationId": "text",
"isTIM": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pbHistory": "[Circular Reference]",
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"quiet": true,
"recoveryAttempts": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"serverId": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": "[Circular Reference]",
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"syncHash": "text",
"tasks": "[Circular Reference]",
"version": 1,
"view": {},
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
},
"task": {
"brand": "text",
"cacheVersn": 1,
"clonedFrom": "text",
"comment": "text",
"conditions": [
"text"
],
"created": "2026-01-01T00:00:00.000Z",
"description": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"isCommand": true,
"isLocked": true,
"isTitleTask": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"playbookId": "text",
"playbookName": "text",
"primaryTerm": 1,
"scriptId": "text",
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"tags": [
"text"
],
"type": "text",
"version": 1
},
"taskCompleteData": [
{
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"calculatedDescription": "text",
"calculatedTaskName": "text",
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"entries": [
"text"
],
"hasErrorEntries": true,
"input": "text",
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"startDate": "2026-01-01T00:00:00.000Z",
"state": "text",
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
],
"taskDebug": {
"breakpointCondition": "[Circular Reference]",
"inputOverrides": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"isMarkedWithBreakpoint": true,
"isMarkedWithSkip": true,
"outputOverrides": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"shouldOverrideDebugInfo": true,
"skipConditionOverrideTo": "text",
"taskOriginalId": "text"
},
"taskId": "text",
"taskSize": 1,
"timerTriggers": [
{
"action": "text",
"fieldName": "text"
}
],
"timesPolled": 1,
"type": "text",
"view": {},
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
},
"view": {}
}
],
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"quiet": true,
"recoveryAttempts": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"serverId": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
]
},
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"syncHash": "text",
"tasks": {
"ANY_ADDITIONAL_PROPERTY": {
"Reopen": true,
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"assignee": "text",
"assigneeSet": true,
"blockingTasks": [
"text"
],
"calculatedDescription": "text",
"calculatedTaskName": "text",
"comments": true,
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"conditions": [
{
"condition": [
"[Circular Reference]"
],
"label": "text"
}
],
"continueOnError": true,
"continueOnErrorType": "text",
"defaultAssignee": "text",
"defaultAssigneeComplex": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
},
"defaultReminder": 1,
"doNotSaveTaskHistory": true,
"dueDate": "2026-01-01T00:00:00.000Z",
"dueDateDuration": 1,
"dueDateDurationUnit": 1,
"dueDateSet": true,
"entries": [
"text"
],
"evidenceData": {
"customFields": "[Circular Reference]",
"description": "[Circular Reference]",
"occurred": "[Circular Reference]",
"tags": "[Circular Reference]"
},
"executionCount": 1,
"externalFormUseAuth": true,
"fieldMapping": [
{
"fieldId": "text",
"output": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
}
}
],
"forEachIndex": 1,
"forEachInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{}
]
},
"form": {
"description": "text",
"expired": true,
"questions": "[Circular Reference]",
"sender": "text",
"title": "text",
"totalAnswers": 1
},
"formDisplay": {
"bodyBackgroundColor": "text",
"bodyFontColor": "text",
"headerBackgroundColor": "text",
"headerFontColor": "text",
"isExternalRtl": true,
"sender": "text",
"submitButtonBackgroundColor": "text",
"submitButtonFontColor": "text",
"submitText": "text"
},
"hasErrorEntries": true,
"id": "text",
"ignoreWorker": true,
"indent": 1,
"input": "text",
"isAutoSwitchedToQuietMode": true,
"isOverSize": true,
"loop": {
"brand": "text",
"builtinCondition": "[Circular Reference]",
"exitCondition": "text",
"forEach": true,
"isCommand": true,
"max": 1,
"scriptArguments": "[Circular Reference]",
"scriptId": "text",
"scriptName": "text",
"wait": 1
},
"message": {
"bcc": "[Circular Reference]",
"body": "[Circular Reference]",
"cc": "[Circular Reference]",
"defaultOption": "text",
"format": "text",
"methods": [
"text"
],
"replyOptions": [
"text"
],
"subject": "[Circular Reference]",
"timings": {
"completeAfterReplies": 1,
"completeAfterSLA": true,
"completeAfterV2": true,
"retriesCount": 1,
"retriesInterval": 1
},
"to": "[Circular Reference]"
},
"missingContentItem": "text",
"nextPollingTime": "2026-01-01T00:00:00.000Z",
"nextTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"note": true,
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"parentBlockCount": 1,
"parentPlaybookID": "text",
"patched": true,
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingEntries": [
"text"
],
"pollingTimeoutTime": "2026-01-01T00:00:00.000Z",
"previousTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"quietMode": 1,
"reminder": 1,
"reputationCalc": 1,
"restrictedCompletion": true,
"scriptArguments": {
"ANY_ADDITIONAL_PROPERTY": "[Circular Reference]"
},
"separateContext": true,
"skip": true,
"skipUnavailable": true,
"sla": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"slaReminder": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"startDate": "2026-01-01T00:00:00.000Z",
"startedExecutingHarmfulScript": true,
"state": "text",
"subPlaybook": {
"Dirty": true,
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"ReplacedPlaybook": true,
"ShardID": 1,
"UpdatedOperatorIDs": true,
"allRead": true,
"allReadWrite": true,
"autoExtracting": true,
"cacheVersn": 1,
"comment": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentCreateDate": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"inputs": "[Circular Reference]",
"invPBDebugInfo": {
"originalInvPBId": "text"
},
"investigationId": "text",
"isTIM": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pbHistory": "[Circular Reference]",
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"quiet": true,
"recoveryAttempts": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"serverId": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": "[Circular Reference]",
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"syncHash": "text",
"tasks": "[Circular Reference]",
"version": 1,
"view": {},
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
},
"task": {
"brand": "text",
"cacheVersn": 1,
"clonedFrom": "text",
"comment": "text",
"conditions": [
"text"
],
"created": "2026-01-01T00:00:00.000Z",
"description": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"isCommand": true,
"isLocked": true,
"isTitleTask": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"playbookId": "text",
"playbookName": "text",
"primaryTerm": 1,
"scriptId": "text",
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"tags": [
"text"
],
"type": "text",
"version": 1
},
"taskCompleteData": [
{
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"calculatedDescription": "text",
"calculatedTaskName": "text",
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"entries": [
"text"
],
"hasErrorEntries": true,
"input": "text",
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"startDate": "2026-01-01T00:00:00.000Z",
"state": "text",
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
],
"taskDebug": {
"breakpointCondition": "[Circular Reference]",
"inputOverrides": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"isMarkedWithBreakpoint": true,
"isMarkedWithSkip": true,
"outputOverrides": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"shouldOverrideDebugInfo": true,
"skipConditionOverrideTo": "text",
"taskOriginalId": "text"
},
"taskId": "text",
"taskSize": 1,
"timerTriggers": [
{
"action": "text",
"fieldName": "text"
}
],
"timesPolled": 1,
"type": "text",
"view": {},
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
},
"version": 1,
"view": {},
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}OK
{
"Dirty": true,
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"ReplacedPlaybook": true,
"ShardID": 1,
"UpdatedOperatorIDs": true,
"allRead": true,
"allReadWrite": true,
"autoExtracting": true,
"cacheVersn": 1,
"comment": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentCreateDate": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"inputs": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
],
"invPBDebugInfo": {
"originalInvPBId": "text"
},
"investigationId": "text",
"isTIM": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pbHistory": [
{
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"autoExtracting": true,
"comment": "text",
"inputs": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
],
"investigationId": "text",
"isTIM": true,
"name": "text",
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"quiet": true,
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
]
},
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"tasks": {
"ANY_ADDITIONAL_PROPERTY": {
"Reopen": true,
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"assignee": "text",
"assigneeSet": true,
"blockingTasks": [
"text"
],
"calculatedDescription": "text",
"calculatedTaskName": "text",
"comments": true,
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"conditions": [
"[Circular Reference]"
],
"continueOnError": true,
"continueOnErrorType": "text",
"defaultAssignee": "text",
"defaultAssigneeComplex": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
},
"defaultReminder": 1,
"doNotSaveTaskHistory": true,
"dueDate": "2026-01-01T00:00:00.000Z",
"dueDateDuration": 1,
"dueDateDurationUnit": 1,
"dueDateSet": true,
"entries": [
"text"
],
"evidenceData": {
"customFields": "[Circular Reference]",
"description": "[Circular Reference]",
"occurred": "[Circular Reference]",
"tags": "[Circular Reference]"
},
"executionCount": 1,
"externalFormUseAuth": true,
"fieldMapping": [
"[Circular Reference]"
],
"forEachIndex": 1,
"forEachInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{}
]
},
"form": {
"description": "text",
"expired": true,
"questions": "[Circular Reference]",
"sender": "text",
"title": "text",
"totalAnswers": 1
},
"formDisplay": {
"bodyBackgroundColor": "text",
"bodyFontColor": "text",
"headerBackgroundColor": "text",
"headerFontColor": "text",
"isExternalRtl": true,
"sender": "text",
"submitButtonBackgroundColor": "text",
"submitButtonFontColor": "text",
"submitText": "text"
},
"hasErrorEntries": true,
"id": "text",
"ignoreWorker": true,
"indent": 1,
"input": "text",
"isAutoSwitchedToQuietMode": true,
"isOverSize": true,
"loop": {
"brand": "text",
"builtinCondition": "[Circular Reference]",
"exitCondition": "text",
"forEach": true,
"isCommand": true,
"max": 1,
"scriptArguments": "[Circular Reference]",
"scriptId": "text",
"scriptName": "text",
"wait": 1
},
"message": {
"bcc": "[Circular Reference]",
"body": "[Circular Reference]",
"cc": "[Circular Reference]",
"defaultOption": "text",
"format": "text",
"methods": [
"text"
],
"replyOptions": [
"text"
],
"subject": "[Circular Reference]",
"timings": {
"completeAfterReplies": 1,
"completeAfterSLA": true,
"completeAfterV2": true,
"retriesCount": 1,
"retriesInterval": 1
},
"to": "[Circular Reference]"
},
"missingContentItem": "text",
"nextPollingTime": "2026-01-01T00:00:00.000Z",
"nextTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"note": true,
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"parentBlockCount": 1,
"parentPlaybookID": "text",
"patched": true,
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingEntries": [
"text"
],
"pollingTimeoutTime": "2026-01-01T00:00:00.000Z",
"previousTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"quietMode": 1,
"reminder": 1,
"reputationCalc": 1,
"restrictedCompletion": true,
"scriptArguments": {
"ANY_ADDITIONAL_PROPERTY": "[Circular Reference]"
},
"separateContext": true,
"skip": true,
"skipUnavailable": true,
"sla": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"slaReminder": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"startDate": "2026-01-01T00:00:00.000Z",
"startedExecutingHarmfulScript": true,
"state": "text",
"subPlaybook": {
"Dirty": true,
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"ReplacedPlaybook": true,
"ShardID": 1,
"UpdatedOperatorIDs": true,
"allRead": true,
"allReadWrite": true,
"autoExtracting": true,
"cacheVersn": 1,
"comment": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentCreateDate": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"inputs": "[Circular Reference]",
"invPBDebugInfo": {
"originalInvPBId": "text"
},
"investigationId": "text",
"isTIM": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pbHistory": "[Circular Reference]",
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"quiet": true,
"recoveryAttempts": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"serverId": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": "[Circular Reference]",
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"syncHash": "text",
"tasks": "[Circular Reference]",
"version": 1,
"view": {},
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
},
"task": {
"brand": "text",
"cacheVersn": 1,
"clonedFrom": "text",
"comment": "text",
"conditions": [
"text"
],
"created": "2026-01-01T00:00:00.000Z",
"description": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"isCommand": true,
"isLocked": true,
"isTitleTask": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"playbookId": "text",
"playbookName": "text",
"primaryTerm": 1,
"scriptId": "text",
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"tags": [
"text"
],
"type": "text",
"version": 1
},
"taskCompleteData": [
{
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"calculatedDescription": "text",
"calculatedTaskName": "text",
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"entries": [
"text"
],
"hasErrorEntries": true,
"input": "text",
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"startDate": "2026-01-01T00:00:00.000Z",
"state": "text",
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
],
"taskDebug": {
"breakpointCondition": "[Circular Reference]",
"inputOverrides": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"isMarkedWithBreakpoint": true,
"isMarkedWithSkip": true,
"outputOverrides": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"shouldOverrideDebugInfo": true,
"skipConditionOverrideTo": "text",
"taskOriginalId": "text"
},
"taskId": "text",
"taskSize": 1,
"timerTriggers": [
{
"action": "text",
"fieldName": "text"
}
],
"timesPolled": 1,
"type": "text",
"view": {},
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
},
"view": {}
}
],
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"quiet": true,
"recoveryAttempts": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"serverId": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"description": "text",
"key": "text",
"playbookInputQuery": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"queryEntity": "text",
"queryState": {
"batchSize": 1,
"currentPage": 1,
"searchAfter": [
"text"
],
"totalResults": 1
},
"results": {},
"runFromLastJobTime": true,
"toDate": "2026-01-01T00:00:00.000Z"
},
"required": true,
"value": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": [
{
"key": "text",
"value": "[Circular Reference]"
}
],
"simple": "text"
}
}
]
},
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"syncHash": "text",
"tasks": {
"ANY_ADDITIONAL_PROPERTY": {
"Reopen": true,
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"assignee": "text",
"assigneeSet": true,
"blockingTasks": [
"text"
],
"calculatedDescription": "text",
"calculatedTaskName": "text",
"comments": true,
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"conditions": [
{
"condition": [
"[Circular Reference]"
],
"label": "text"
}
],
"continueOnError": true,
"continueOnErrorType": "text",
"defaultAssignee": "text",
"defaultAssigneeComplex": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
},
"defaultReminder": 1,
"doNotSaveTaskHistory": true,
"dueDate": "2026-01-01T00:00:00.000Z",
"dueDateDuration": 1,
"dueDateDurationUnit": 1,
"dueDateSet": true,
"entries": [
"text"
],
"evidenceData": {
"customFields": "[Circular Reference]",
"description": "[Circular Reference]",
"occurred": "[Circular Reference]",
"tags": "[Circular Reference]"
},
"executionCount": 1,
"externalFormUseAuth": true,
"fieldMapping": [
{
"fieldId": "text",
"output": {
"complex": {
"accessor": "text",
"filters": [
"[Circular Reference]"
],
"root": "text",
"transformers": [
"[Circular Reference]"
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
}
}
],
"forEachIndex": 1,
"forEachInputs": {
"ANY_ADDITIONAL_PROPERTY": [
{}
]
},
"form": {
"description": "text",
"expired": true,
"questions": "[Circular Reference]",
"sender": "text",
"title": "text",
"totalAnswers": 1
},
"formDisplay": {
"bodyBackgroundColor": "text",
"bodyFontColor": "text",
"headerBackgroundColor": "text",
"headerFontColor": "text",
"isExternalRtl": true,
"sender": "text",
"submitButtonBackgroundColor": "text",
"submitButtonFontColor": "text",
"submitText": "text"
},
"hasErrorEntries": true,
"id": "text",
"ignoreWorker": true,
"indent": 1,
"input": "text",
"isAutoSwitchedToQuietMode": true,
"isOverSize": true,
"loop": {
"brand": "text",
"builtinCondition": "[Circular Reference]",
"exitCondition": "text",
"forEach": true,
"isCommand": true,
"max": 1,
"scriptArguments": "[Circular Reference]",
"scriptId": "text",
"scriptName": "text",
"wait": 1
},
"message": {
"bcc": "[Circular Reference]",
"body": "[Circular Reference]",
"cc": "[Circular Reference]",
"defaultOption": "text",
"format": "text",
"methods": [
"text"
],
"replyOptions": [
"text"
],
"subject": "[Circular Reference]",
"timings": {
"completeAfterReplies": 1,
"completeAfterSLA": true,
"completeAfterV2": true,
"retriesCount": 1,
"retriesInterval": 1
},
"to": "[Circular Reference]"
},
"missingContentItem": "text",
"nextPollingTime": "2026-01-01T00:00:00.000Z",
"nextTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"note": true,
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"parentBlockCount": 1,
"parentPlaybookID": "text",
"patched": true,
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"pollingEntries": [
"text"
],
"pollingTimeoutTime": "2026-01-01T00:00:00.000Z",
"previousTasks": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"quietMode": 1,
"reminder": 1,
"reputationCalc": 1,
"restrictedCompletion": true,
"scriptArguments": {
"ANY_ADDITIONAL_PROPERTY": "[Circular Reference]"
},
"separateContext": true,
"skip": true,
"skipUnavailable": true,
"sla": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"slaReminder": {
"days": 1,
"hours": 1,
"minutes": 1,
"weeks": 1
},
"startDate": "2026-01-01T00:00:00.000Z",
"startedExecutingHarmfulScript": true,
"state": "text",
"subPlaybook": {
"Dirty": true,
"ReadyPlaybookInputs": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {}
}
},
"ReplacedPlaybook": true,
"ShardID": 1,
"UpdatedOperatorIDs": true,
"allRead": true,
"allReadWrite": true,
"autoExtracting": true,
"cacheVersn": 1,
"comment": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentCreateDate": "2026-01-01T00:00:00.000Z",
"indexName": "text",
"inputs": "[Circular Reference]",
"invPBDebugInfo": {
"originalInvPBId": "text"
},
"investigationId": "text",
"isTIM": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
],
"pbHistory": "[Circular Reference]",
"pendingTasks": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"quiet": true,
"recoveryAttempts": 1,
"roles": [
"text"
],
"sequenceNumber": 1,
"serverId": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"startDate": "2026-01-01T00:00:00.000Z",
"startTaskId": "text",
"state": "text",
"subPlaybookInputs": "[Circular Reference]",
"subPlaybookOutputs": {
"ANY_ADDITIONAL_PROPERTY": [
{
"contextPath": "text",
"description": "text",
"type": "text"
}
]
},
"syncHash": "text",
"tasks": "[Circular Reference]",
"version": 1,
"view": {},
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
},
"task": {
"brand": "text",
"cacheVersn": 1,
"clonedFrom": "text",
"comment": "text",
"conditions": [
"text"
],
"created": "2026-01-01T00:00:00.000Z",
"description": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"isCommand": true,
"isLocked": true,
"isTitleTask": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"playbookId": "text",
"playbookName": "text",
"primaryTerm": 1,
"scriptId": "text",
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"tags": [
"text"
],
"type": "text",
"version": 1
},
"taskCompleteData": [
{
"arguments": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"calculatedDescription": "text",
"calculatedTaskName": "text",
"completedBy": "text",
"completedCount": 1,
"completedDate": "2026-01-01T00:00:00.000Z",
"entries": [
"text"
],
"hasErrorEntries": true,
"input": "text",
"outputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"playbookInputs": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"startDate": "2026-01-01T00:00:00.000Z",
"state": "text",
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
],
"taskDebug": {
"breakpointCondition": "[Circular Reference]",
"inputOverrides": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"isMarkedWithBreakpoint": true,
"isMarkedWithSkip": true,
"outputOverrides": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"shouldOverrideDebugInfo": true,
"skipConditionOverrideTo": "text",
"taskOriginalId": "text"
},
"taskId": "text",
"taskSize": 1,
"timerTriggers": [
{
"action": "text",
"fieldName": "text"
}
],
"timesPolled": 1,
"type": "text",
"view": {},
"willNotExecuteCount": 1,
"willNotExecuteReason": "text"
}
},
"version": 1,
"view": {},
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}Clone an existing playbook by specifying its playbook ID.
Playbook ID
{api_key}
{api_key_id}
OK
POST /xsoar/public/v1/playbook/clone/{playbook_id} HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Accept: */*
OK
{
"id": "96a0127e-cc9b-4946-4b08-68c5ee763328",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 91021006,
"primaryTerm": 14,
"modified": "2025-04-27T11:38:55.652786718Z",
"sizeInBytes": 1850,
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"propagationLabels": [
"all"
],
"definitionId": "",
"isOverridable": false,
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "playbook_mkj7jS4K_copy",
"nameRaw": "playbook_mkj7jS4K_copy",
"prevName": "playbook_mkj7jS4K_copy",
"startTaskId": "0",
"tasks": {
"0": {
"id": "0",
"taskId": "db7a60dc-7e49-44a0-8111-eab74746aa8d",
"type": "start",
"task": {
"id": "db7a60dc-7e49-44a0-8111-eab74746aa8d",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 91020997,
"primaryTerm": 14,
"modified": "2025-04-27T11:38:49.956893197Z",
"sizeInBytes": 174,
"description": "hQLBLw",
"type": "regular"
},
"nextTasks": {
"#none#": [
"1"
]
},
"continueOnErrorType": "",
"view": {
"position": {
"x": 50,
"y": 250
}
},
"evidenceData": {}
},
"1": {
"id": "1",
"taskId": "41fc95d2-227c-4c75-87e6-39f4369f474c",
"type": "regular",
"task": {
"id": "41fc95d2-227c-4c75-87e6-39f4369f474c",
"version": 1,
"cacheVersn": 0,
"sequenceNumber": 91020998,
"primaryTerm": 14,
"modified": "2025-04-27T11:38:49.976719806Z",
"sizeInBytes": 248,
"name": "print task uA5ts2pH",
"description": "kvkIfkhh",
"scriptId": "Print",
"type": "regular",
"isCommand": true
},
"scriptArguments": {
"value": {
"simple": "2pOobkAM"
}
},
"continueOnErrorType": "",
"view": {
"position": {
"x": 50,
"y": 430
}
},
"evidenceData": {}
}
},
"taskIds": [
"db7a60dc-7e49-44a0-8111-eab74746aa8d",
"41fc95d2-227c-4c75-87e6-39f4369f474c"
],
"scriptIds": [],
"commands": [
"Print"
],
"brands": [
""
],
"view": {
"linkLabelsPosition": {},
"paper": {
"dimensions": {
"height": 65,
"width": 380,
"x": 50,
"y": 50
}
}
},
"inputs": null,
"outputs": null,
"sourcePlaybookID": "3d7a44e2-60ee-4493-8e2c-013e68ed042f"
}Last updated
Was this helpful?
