After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
Configure labels to apply to containers
Labels are a property applied to containers. A label applied to a container enables to run playbooks and other automation against containers.
ships with one label defined: events. More labels can be added to suit your workflow or organizational needs. Labels can have additional custom fields, be used as the basis of a HUD Card, or have tags required before the label's container can be set to a closed or resolved status.
Create a label
Perform the following steps to create a label:
- From the Home menu, select Administration.
- Click Event Settings > Label Settings.
- Click + Label.
- Type a name for the label.
- Click Create.
Delete or modify a label
Delete a label by clicking the ⓧ icon to the right of the label's name.
Perform the following tasks to modify a label:
- From the Home menu, select Administration.
- Click Event Settings > Label Settings.
- Click the label's name in the list.
- Click either Custom Fields, HUD, or Resolution. Each of these items behaves identically to the top-level settings of the same name.
- For Custom Fields settings, see Create custom fields for containers.
- For HUD settings, see Track information about an event or case using HUD cards.
- For Resolution settings, see Configure how events are resolved.
Configure how events are resolved | Use authorized users to grant authorized access |
This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.4.0, 5.5.0, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2, 6.3.0
Feedback submitted, thanks!