End-of-Life (EoL)

Manage Playbook Settings

playbooks managing
You can manage general playbook settings such as the name, who can edit and run the playbook, as well as for which incident types the playbook runs in the playbook settings.
  1. From the Playbooks page, click the playbook that you want to manage.
  2. (
    ) To update playbook triggers or the playbook quiet mode, click
    Detach Playbook
    If you want to reattach a playbook and keep any changes, ensure that you duplicate the playbook before reattaching.
  3. Click
  4. Add the following settings as required.
    1. In the
      field, from the dropdown list, select the roles for which the playbook is available.
    2. In the
      Playbook triggers
      section, select the incident types for which this playbook runs.
      This overwrites the settings configured in the respective incident types. The playbook currently defined for the incident type is listed under
      Triggered playbook
    3. In the
      section, determine whether the playbook runs in quiet mode.
      Quiet Mode
      is selected, playbook tasks do not display inputs and outputs and do not auto-extract indicators.
      Playbook tasks are not indexed so you cannot search on the results of specific tasks. All of the information is still available in the context data, and errors and warnings are written to the War Room.
      Quiet Mode
      is recommended for scenarios that involve a lot of information that might adversely affect performance, for example, processing indicators from threat intel feeds.
      You can run the
      command to analyze the size of playbook tasks to determine whether to implement quiet mode for playbooks or tasks.
  5. Click

Recommended For You