If you define a playbook task input that pulls from indicators,
the entire playbook runs in Quiet Mode. This means the task or playbook
information is not written to the War Room, and inputs and outputs
are not displayed in the playbook. However, errors and warnings
are still written to the War Room.
You should not run a query on a field
that you might change in the playbook flow. For example, you shouldn’t
have a playbook with query
Verdict:Malicious
and
then change the indicator verdict as a part of the playbook.
