Manage Cortex XSOAR playbook settings, including role
access, which incident type triggers it, and options for Quiet Mode.
You can manage general playbook settings such
as the name, who can edit and run the playbook, as well as for which
incident types the playbook runs in the playbook settings.
From the Playbooks page, click the playbook that
you want to manage.
) To update playbook triggers or the
playbook quiet mode, click
If you want to reattach a
playbook and keep any changes, ensure that you duplicate the playbook
Add the following settings as required.
from the dropdown list, select the roles for which the playbook
the incident types for which this playbook runs.
This overwrites the settings configured in the respective
incident types. The playbook currently defined for the incident
type is listed under
section, determine whether
the playbook runs in quiet mode.
is selected, playbook
tasks do not display inputs and outputs and do not auto-extract
Playbook tasks are not indexed so you cannot
search on the results of specific tasks. All of the information
is still available in the context data, and errors and warnings
are written to the War Room.
for scenarios that involve a lot of information that might adversely affect
performance, for example, processing indicators from threat intel feeds.
can run the
analyze the size of playbook tasks to determine whether to implement
quiet mode for playbooks or tasks.