Export and import playbooks in

You can export, or download, and import, or upload, playbooks in to share them with other tenants.

You can import playbooks into tenants that use the same or higher version of Splunk SOAR (Cloud) and the same playbook editor (Modern Visual Playbook Editor or Classic Playbook Editor).

Export a playbook to your local filesystem

Perform the following tasks to export a playbook from the playbooks table. The playbook is downloaded as a JSON file to your local filesystem.

1. From the Home menu, select Playbooks.
2. Select the checkbox for the playbook you want to export.
3. Select Export.

You can also export a playbook while you are editing the playbook in the playbook editor. In order to export a playbook, you must save it at least once. The export will download the latest saved version of the playbook.

Perform the following tasks to export a playbook from the classic playbook editor:

1. Make sure there is at least one saved version of the playbook.
2. In the playbook editor, select Playbook Settings.
3. Select Export Playbook.

Perform the following tasks to export a playbook from the modern playbook editor:

1. Make sure there is at least one saved version of the playbook.
2. In the playbook editor, select the more icon ( ).
3. Select Export.

Import a playbook to

Perform the following tasks to import a playbook. The imported playbook is treated as a new playbook.

1. From the Home menu, select Playbooks.
2. Select the Import Playbook icon () to add a playbook to .
3. Set the source control repository to which the playbook will be uploaded.
4. (Conditional) If you are uploading a playbook with the same name as an existing playbook, check the Force Update checkbox.
5. Drag and drop your .tgz compressed playbook file onto the Select Playbook Archive field, or select that field to browse to select the playbook archive from your file system.
6. Select Upload.

Missing configurations in imported playbooks

When you import a playbook from a different Splunk SOAR environment or from a different repository, such as the Splunk SOAR Community repository, one or more action block configurations for that playbook might not be found on your system. Playbooks will not run if they have one or more missing configurations.

When you open a playbook with missing configurations, a warning displays on the top of the screen.

To connect missing configurations for your imported playbook, follow these steps.

1. Select the link on the warning message to view the missing configurations.
2. For each of the missing configurations shown, use the list provided to select an appropriate asset configuration to link to that action block.
   • If multiple action blocks use the same missing asset configuration, when you create the link for the first action block in this step, the other mappings for the same asset configuration resolve automatically.
   • If you do not have an appropriate configuration installed, select the link provided to add a new configuration.

   When creating the new asset configuration, if you use the exact same name as the missing asset configuration, the mappings resolve automatically.

3. Select Save.

The warning continues to display until you have resolved all missing configurations.