Manage Playbook Settings

Manage Cortex XSOAR playbook settings, including role access, which incident type triggers it, and options for Quiet Mode.
You can manage general playbook settings such as the name, who can edit and run the playbook, as well as for which incident types the playbook runs in the playbook settings.
  1. From the Playbooks page, click the playbook that you want to manage.
  2. (
    Optional
    ) To update playbook triggers or the playbook quiet mode, click
    Detach Playbook
    .
    If you want to reattach a playbook and keep any changes, ensure that you duplicate the playbook before reattaching.
  3. Click
    Settings
    .
  4. Add the following settings as required.
    1. In the
      Roles
      field, from the dropdown list, select the roles for which the playbook is available.
    2. In the
      Playbook triggers
      section, select the incident types for which this playbook runs.
      This overwrites the settings configured in the respective incident types. The playbook currently defined for the incident type is listed under
      Triggered playbook
      .
    3. In the
      Advanced
      section, determine whether the playbook runs in quiet mode.
      When
      Quiet Mode
      is selected, playbook tasks do not display inputs and outputs and do not auto-extract indicators.
      Playbook tasks are not indexed so you cannot search on the results of specific tasks. All of the information is still available in the context data, and errors and warnings are written to the War Room.
      Quiet Mode
      is recommended for scenarios that involve a lot of information that might adversely affect performance, for example, processing indicators from threat intel feeds.
  5. Click
    Save
    .

Recommended For You