Within the workplan, you can create tasks
for a specific iteration of a playbook. The task type can be an
automation or another playbook. For example, within a manual task,
you might need to enrich some data and can run an investigation
When you create a task, add a name, automation,
and description. The name and description should be meaningful so
that the task corresponds to the data that you are collecting.
In the Work Plan, click the + sign at the bottom right-hand
corner of the task to which you want to add the ad-hoc task. The ad-hoc
task is added after the task on which you clicked.
Select the task type.
Standard - run a single automation.
Playbook - run a playbook to enhance the investigation.
playbook functions as any playbook would and requires you to define
the inputs and outputs, as well as any other details.
Click a task in the Work Plan and click
An example use case could be where you have a phishing
investigation and the initial playbook run has parsed the email
and extracted several indicators, including some email addresses.
part of the manual investigation, you could use the Email Address
Enrichment playbook as an adhoc playbook task to get more information
about these email addresses.