Create playbooks in Splunk SOAR

Create a playbook in Splunk SOAR to automate security workflows so analysts can spend more time performing analysis and investigation. The playbook editor provides a visual platform for creating playbooks without having to write code.

To define a workflow that you want to automate, link together a series of actions that are provided by apps. An app is third-party software integrated with Splunk SOAR. For example, you can integrate MaxMind as an app, which provides a geolocate ip action, or integrate Okta as app to provide actions such as set password or enable user. The actions available for use in your playbooks are determined by the apps integrated with Splunk SOAR.

After you create and save a playbook in Splunk SOAR, you can run playbooks when performing these tasks in Splunk SOAR:

• Triaging or investigating cases as an analyst
• Creating or adding a case to Investigation
• Configuring playbooks to run automatically directly from the playbook editor

See also

Refer to the following documentation for details on creating and running playbooks.

Creating playbooks

To create playbooks in Splunk SOAR:

• Use playbooks to automate analyst workflows in Splunk SOAR (Cloud)

To use data from Splunk Enterprise Security, create a Splunk Enterprise Security type playbook and Splunk Enterprise Security playbook blocks:

• Create a new playbook in Splunk SOAR (Cloud)
• Automate responses with Splunk Enterprise Security playbook blocks

To optionally create playbooks using APIs:

• About Splunk SOAR (Cloud) playbook automation APIs in the Python Playbook API Reference for Splunk SOAR (Cloud) documentation

Running playbooks

Analysts can run playbooks from within the Splunk Enterprise Security Analyst Queue:

• Manage analyst workflows using the analyst queue in Splunk Enterprise Security