Use the tagging system with the playbook pack for Splunk SOAR

Tags allow you to call playbooks any time the tag is present.

Use input playbook tags compatible with the playbook pack

Playbooks in specified repositories are automatically called if the associated tag is present. The default repository is local.

All input playbooks must include "risk_notable" in addition to the tag itself.

Playbook use	Tags (required)	Outputs (optional)
Investigation or enrichment	investigate	note_title, note_content
Blocking indicators	block	N/A
Containment of assets	asset, containment	N/A
Containment of identities	identity, containment	N/A
Undo containment of assets	asset, undo_containment	N/A
Undo containment of identities	identity, undo_containment	N/A

Understand the indicator tagging system

The risk_notable_review_indicators and risk_notable_block_indicators playbooks use the indicator_get_by_tag utility to fetch indicators with specific tags. To include an indicator with the playbook pack, the playbook used to investigate the indicator type must tag that indicator using the indicator_tag utility.

This table lists the available indicator tags and how you can use them:

Indicator tag	How the playbook pack uses the indicator tag	How you should use the tag in custom input playbooks
suspicious malicious	The risk_notable_review_indicators playbook alerts the user to any indicators that contain this tag.	When building an investigation playbook, use this tag with an indicator. See the Example child playbook deployment topic for an example of how to deploy a child playbook.
safe	The risk_notable_review_indicators and risk_notable_block_indicators playbooks ignore indicators with this tag.	When building investigation playbooks, use this tag to mark safe indicators.
marked_for_block	* The risk_notable_review_indicators playbook alerts the user to any indicators that contain this tag. The risk_notable_block_indicators playbook blocks any indicators with this tag.	N/A
blocked	* The risk_notable_review_indicators playbook ignores indicators with this tag. The risk_notable_block_indicators playbook reports any indicator with this tag, marking each indicator as "successfully blocked."	When building a blocking playbook, use this tag to mark indicators when successful blocks occur.
known_asset known_identity	* The risk_notable_auto_containment playbook routes indicators with this tag to containment input playbooks. The splunk_enterprise_security_tag_assets_and_identities playbook automatically applies this tag.	N/A
contained	* The risk_notable_auto_containment playbook ignores this tag. The risk_notable_undo_containment playbook routes indicators with this tag to undo containment input playbooks.	When building a containment playbook, use this tag to mark indicators when successful containments occur.