After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
Require user input to continue running the playbook using the classic playbook editor
You can configure a task or prompt in your playbook that must be acknowledged by a user before further actions in the playbook are run. You can configure the following types of user input in a playbook:
- A manual task using a Manual Task block that must be acknowledged by a user.
- A prompt using a Prompt block that must be acknowledged by a user. You can configure a specific response type with a Prompt block.
Require user input using the Manual Task block in your playbook
Use a Manual Task block to send a message to a user or group that they must acknowledge. This is the same as manually running a task action from the Investigation menu.
To configure a manual task, perform the following tasks:
- Drop a new block onto the playbook editor.
- Click on the block, then select Manual Task from the block types.
- Select an Approver from the drop-down list. If the task is assigned to a group of users, the first user to process it completes the task.
- From the Required response time field, choose the response time in minutes.
- In the Message box, craft a meaningful message so the users receiving the message understand what actions they must take.
Require user input using the Prompt block in your playbook
Use a Prompt block in your playbook to send a message to a user or group that they must acknowledge.
To configure a prompt, perform the following tasks:
- Drop a new block onto the playbook editor.
- Click on the block, and then select Prompt from the block types.
- Select an Approver from the drop-down list. If the task is assigned to a group of users, the first user to process it completes the task.
- From the Required response time field, choose the response time in minutes.
- In the Message box, craft a meaningful message so the users receiving the message understand what actions they must take. Markdown is supported.
- From the Responses drop-down list, choose the type of response required to complete the task. If the response type is Message, markdown is supported.
See https://guides.github.com/features/mastering-markdown/ for more information on the type of Markdown that can be used in the Message box.
Customize the format of your playbook content using the classic playbook editor | Set container parameters in using the API block with the classic playbook editor |
This documentation applies to the following versions of Splunk® SOAR (On-premises): 5.1.0, 5.2.1, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.4.0, 5.5.0, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2, 6.3.0
Feedback submitted, thanks!