diff --git a/docs/cloud-soar/automation.md b/docs/cloud-soar/automation.md index 0fac393f2a..69ddc1a54a 100644 --- a/docs/cloud-soar/automation.md +++ b/docs/cloud-soar/automation.md @@ -17,14 +17,30 @@ The **Automation** section contains configuration tools for Cloud SOAR's automat Because Cloud SOAR provides automation functionality to the [Automation Service](/docs/platform-services/automation-service/), many features are identical between Cloud SOAR and the Automation Service. Therefore, for information about the following Cloud SOAR features, see the Automation Service articles: * [App Central](/docs/platform-services/automation-service/app-central/) -* [Playbooks](/docs/platform-services/automation-service/automation-service-playbooks/) * [Integrations](/docs/platform-services/automation-service/automation-service-integrations/) * [Automation bridge](/docs/platform-services/automation-service/automation-service-bridge) * [Integration framework](/docs/platform-services/automation-service/integration-framework/) * [Audit logging](/docs/platform-services/automation-service/automation-service-audit-logging) +* [Playbooks](/docs/platform-services/automation-service/automation-service-playbooks/). (For information specific to running playbooks in Cloud SOAR, see [Run playbooks in Cloud SOAR](#run-playbooks-in-cloud-soar) below.) The following sections describe automation features only used in Cloud SOAR. +## Run playbooks in Cloud SOAR + +In Cloud SOAR, playbooks are run from [incidents](/docs/cloud-soar/incidents-triage/#incidents). To run playbooks in Cloud SOAR, perform the following steps: +1. [Create a playbook](/docs/platform-services/automation-service/automation-service-playbooks/#create-a-new-playbook) to use in incident response. When you create the playbook, do the following: + 1. Click the **Edit** icon on the **Start** node:
Start node + 1. Ensure that the **Add one or more params as a playbook input** field is left blank:
Edit node dialog
Do *not* click the field to show the dropdown menu:
Types of start node parameters
The other values in the field are used for automation outside of Cloud SOAR: + * **Insight** and **Entity** are for launching a playbook from a Cloud SIEM automation. + * **Alert** is for launching a playbook from a monitor. + * **Parse from JSON** is for launching a playbook from another playbook. + 1. Proceed to create the playbook as needed. +1. [Create an incident template](#create-a-new-incident-template) to be assigned to incidents. When you create the template, add the playbook to the template and select **Autorun** to run the playbook when the incident is created, or deselect if you want to manually run the playbook from the incident.
New template +1. Monitor and run playbooks on [incidents](/docs/cloud-soar/incidents-triage/#incidents): + * Within an incident, select **Operations > Playbooks** to see the playbooks assigned to the incident. + * If playbooks haven't been assigned by an incident template, you can add playbooks by clicking the **+** button. + * To manually run a playbook for the incident, click the **Run** button at the bottom of the screen.
Playbook on an incident + ## Incident templates Incident templates define the way in which incidents will be created for a specific alert, incident type or event. They allow you to define a certain number of incident attributes (for example, incident type, severity, assignment, and any other default or custom incident parameters) that will automatically be set each time an incident is generated, based on the template. This may include type, classification, incident assignment, playbooks, knowledge base articles, or any other incident attribute. Since rules are created for generating incidents based on syslog messages, email, SIEM integrations, or other data sources, it is the incident templates that will define how the initial incident will be created. diff --git a/docs/platform-services/automation-service/automation-service-playbooks.md b/docs/platform-services/automation-service/automation-service-playbooks.md index 6d98aae5c2..78ead1d7ab 100644 --- a/docs/platform-services/automation-service/automation-service-playbooks.md +++ b/docs/platform-services/automation-service/automation-service-playbooks.md @@ -13,7 +13,7 @@ A playbook is a predefined set of actions and conditional statements that run in Playbooks can be configured to execute automatically without user intervention, acting on information from the incident, or can be executed in interactive mode, where user input is required to authorize predefined actions. -To run a playbook, add it to an automation. For places in Sumo Logic where you can use add playbooks to automations, see [Where you can run automations](/docs/platform-services/automation-service/about-automation-service/#where-you-can-run-automations). +To run a playbook, add it to an automation. You can run playbooks in [monitors](/docs/alerts/monitors/use-playbooks-with-monitors/), [Cloud SIEM](/docs/cse/automation/automations-in-cloud-siem/), and [Cloud SOAR](/docs/cloud-soar/automation/#run-playbooks-in-cloud-soar). :::note @@ -29,7 +29,7 @@ The following procedure describes how to view playbooks already installed in you ## Create a new playbook -Before you create your own playbook, first [view playbooks](#view-playbooks) to make sure there isn't one already that does what you want to accomplish, and also check to see if you can [install a playbook from App Central](/docs/platform-services/automation-service/automation-service-app-central/#install-a-playbook-from-app-central) that does what you need. +Before you create your own playbook, first [view playbooks](#view-playbooks) to make sure there isn't one already that does what you want to accomplish, and also check to see if you can [install a playbook from App Central](/docs/platform-services/automation-service/automation-service-app-central/#install-a-playbook-from-app-central) that does what you need. After you create a playbook, you can run it in automations for [monitors](/docs/alerts/monitors/use-playbooks-with-monitors/), [Cloud SIEM](/docs/cse/automation/automations-in-cloud-siem/), or [Cloud SOAR](/docs/cloud-soar/automation/). :::tip The following procedure provides a brief introduction to how to create a playbook. For detailed examples of how to create playbooks, see the [Cloud SIEM automation examples](/docs/cse/automation/cloud-siem-automation-examples/). @@ -48,7 +48,7 @@ The following procedure provides a brief introduction to how to create a playboo * **Entity**. An [Entity](/docs/cse/records-signals-entities-insights/view-manage-entities/) from an [automation in Cloud SIEM](/docs/cse/automation/automations-in-cloud-siem/). * **Alert**. An [alert](/docs/alerts/) from an [automated playbook in a monitor](/docs/alerts/monitors/use-playbooks-with-monitors/). * **Parse from json**. A payload from a [parent playbook](/docs/platform-services/automation-service/automation-service-playbooks/#add-a-playbook-node-to-a-playbook). (You can also select this option if you want to pass a custom payload from an alert.) - * Leave blank if the trigger will be a Cloud SOAR [incident or triage](/docs/cloud-soar/incidents-triage).
Types of start node parameters + * Leave blank if the trigger will run by a Cloud SOAR incident. See [Run playbooks in Cloud SOAR](/docs/cloud-soar/automation/#run-playbooks-in-cloud-soar).
Types of start node parameters 1. When you select one of these options, standard parameters for the trigger type are displayed. (If you select **Parse from json**, a box appears for you to enter the JSON payload.) Click the **Remove** icon to remove any parameters you don't want passed into the playbook, and if you want to add more parameters, click **Add New Param** at the bottom of the dialog. 1. Click **Update**. The playbook will display a black screen with a **Start** node and an **End** node. These nodes dictate the beginning and the end of the playbook's automation sequence. You can drag and drop them anywhere on the screen to allow you space to add multiple nodes between them. 1. To add the first node in the playbook, click the **+** on the **Start** node. The **Add node** page is displayed.
Add node diff --git a/static/img/cloud-soar/new-incident-template-add-playbook.png b/static/img/cloud-soar/new-incident-template-add-playbook.png new file mode 100644 index 0000000000..c998ea281c Binary files /dev/null and b/static/img/cloud-soar/new-incident-template-add-playbook.png differ diff --git a/static/img/cloud-soar/playbook-on-incident.png b/static/img/cloud-soar/playbook-on-incident.png new file mode 100644 index 0000000000..3f443dc732 Binary files /dev/null and b/static/img/cloud-soar/playbook-on-incident.png differ diff --git a/static/img/platform-services/automation-service/edit-start-node-input.png b/static/img/platform-services/automation-service/edit-start-node-input.png new file mode 100644 index 0000000000..8d11cb1b65 Binary files /dev/null and b/static/img/platform-services/automation-service/edit-start-node-input.png differ