--- title: "Playbooks: Run Profiles Knowledge Base Article | ThreatConnect" slug: "playbooks-run-profiles" description: "Run Profiles represent the data type or event needed to execute a Playbook without navigating away from the Playbook Designer. This article describes how to view, manage, and create Run Profiles and execute a Playbook using a Run Profile." tags: ["Orchestration and Automation"] updated: 2024-11-07T20:02:37Z published: 2024-11-07T20:02:37Z --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Playbooks: Run Profiles ## Overview Run Profiles represent the data type or event needed to execute a Playbook in ThreatConnect® without needing to navigate away from the [Playbook Designer](https://knowledge.threatconnect.com/docs/the-playbook-designer). For example, you can create a Run Profile that represents an HTTP request that will execute when a [WebHook Trigger](/v1/docs/playbooks-the-webhook-trigger) is called, and then you can execute the Playbook using the Run Profile. NoteRun Profiles are available to use with any Playbook in an Organization, not just the Playbook in which they were created. ## Before You Start | Minimum Role(s) | - Organization role of Read Only User (for viewing Run Profiles and Playbooks) - Organization role of Standard User (for creating, modifying, and deleting Run Profiles and activating and de-activating Playbooks) | | --- | --- | | Prerequisites | Playbooks enabled by a System Administrator | ## Viewing and Managing Run Profiles ### Viewing Run Profiles 1. On the top navigation bar, click Playbooks to display the [**Playbooks** screen](https://knowledge.threatconnect.com/docs/the-playbooks-screen). 2. Open an existing [Playbook](https://knowledge.threatconnect.com/docs/playbooks) or create a new one and configure it. 3. Click**![Playbook Designer Run Profiles icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Designer%20Run%20Profiles%20icon.png)Run Profiles** on the side navigation bar of the Playbook Designer****to display the **Run Profiles**pane, which displays the Run Profiles that have been created for the Trigger type used in the Playbook (Figure 1). To view all Run Profiles available in an Organization, toggle the **Show All**slider on while the Playbook is in **Design Mode**or **Interactive Mode**. ![Figure 1_Playbooks - Run Profiles_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Playbooks%20-%20Run%20Profiles_7.7.1.png) NoteAll Run Profiles are available to all users within an Organization, regardless of who created them. ### Editing Run Profiles 1. Click **Edit**![Pencil icon_Black](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Pencil%20icon_Black.png)in the **Options**column for the Run Profile (Figure 1). The **Create Profile**screen will be displayed in the **Run Profiles**pane (Figure 2). ![Figure 2_Playbooks - Run Profiles_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Playbooks%20-%20Run%20Profiles_7.7.1.png) NoteThe Run Profile's **Type** cannot be changed. 2. Click the **NEXT**button to edit the configuration options. The options vary by Trigger type. See the [“Creating Run Profiles"](/docs/playbooks-run-profiles#creating-run-profiles) section for further guidance. ### Deleting Run Profiles Click **Delete**![Delete%20Run%20Profile%20icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Delete%20Run%20Profile%20icon.png)in the **Options**column for the Run Profile (Figure 1). The **Delete Run Profile?**window will be displayed. Click the **DELETE**button. ## Creating Run Profiles Run Profiles are created to represent a specific Indicator, Group, or Intelligence Requirement (IR) in an owner needed to execute the corresponding Indicator, Group, or Intel Requirement Trigger, respectively, or a specific event needed to execute a Mailbox, Timer, or WebHook Trigger. In addition to creating Run Profiles as described in this section, you can [create a Run Profile for a logged Playbook execution](https://knowledge.threatconnect.com/docs/playbook-executions#execution-details) from the **Execution Details**pane while viewing the results of the execution. 1. Click **+ Create Run Profile**at the upper-left corner of the **Run Profiles**pane (Figure 1). The **Create Profile**section will be displayed (Figure 3). ![Figure 3_Playbooks - Run Profiles_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Playbooks%20-%20Run%20Profiles_7.7.1.png) - **Profile Name**: Enter a name for the Run Profile. - **Type**: Select the type of Run Profile to create. The options are all ThreatConnect [Indicator types](https://knowledge.threatconnect.com/v1/docs/the-threatconnect-data-model#indicator-types) and [Group types](https://knowledge.threatconnect.com/v1/docs/the-threatconnect-data-model#group-types), **[Intel Requirement](https://knowledge.threatconnect.com/docs/intelligence-requirements)**, [**Mailbox**](/v1/docs/playbooks-the-mailbox-trigger), [**Timer**](/v1/docs/playbooks-the-timer-trigger), and [**WebHook**](/v1/docs/playbooks-the-webhook-trigger). 2. The configuration options for Run Profiles vary by the Trigger type selected in the **Type** field. See the next set of subsections for guidance on each Trigger type. ### Indicator, Group, or Intel Requirement Trigger 1. Create a new Run Profile as described in the [“Creating Run Profiles"](/docs/playbooks-run-profiles#creating-run-profiles) section and select an Indicator or Group type or **Intel Requirement** as the **Type**. An **Owner** dropdown will be displayed (Figure 4). ![Figure 4_Playbooks - Run Profiles_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Playbooks%20-%20Run%20Profiles_7.7.1.png) - **Owner**: Select the owner that contains the Indicator, Group, or IR that will act as the trigger for the Run Profile. - Click the **NEXT**button. 2. The **Configure**section will be displayed, showing a text field corresponding to the Indicator or Group type, or **Intel Requirement** for the **Intel Requirement** type, that was selected in the previous step (Figure 5). ![Figure 5_Playbooks - Run Profiles_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_Playbooks%20-%20Run%20Profiles_7.7.1.png) 3. Enter the name/summary****of the Indicator, Group, or IR that will be used to execute the Playbook into the text field. As you type, a list of results matching the text entered will be displayed. Select an object from the list of results. Information about the object will be displayed (Figure 6). Click the![Open in New Window icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Open%20in%20New%20Window%20icon.png)icon to view the object’s [**Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen). ![Figure 6_Playbooks - Run Profiles_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_Playbooks%20-%20Run%20Profiles_7.7.1.png) 4. Click the **SAVE**button.NoteIf a Run Profile is not displayed in the **Run Profiles** pane after you create it, ensure that the Playbook uses a Trigger type that matches the Run Profile’s **Type**. Alternatively, toggle the **Show All** switch on to display all Run Profiles in your Organization. ### Mailbox Trigger Create a new Run Profile as described in the [“Creating Run Profiles"](/docs/playbooks-run-profiles#creating-run-profiles) section, select **Mailbox** as the **Type**, and click the **NEXT**button. The **Configure**section will be displayed (Figure 7). ![Figure 7_Playbooks - Run Profiles_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%207_Playbooks%20-%20Run%20Profiles_7.7.1.png) - **trg.mbox.header (KeyValueArray)**: Enter the mailbox header in a key/value format. - **trg.mbox.header (String)**: Enter the mailbox header in string format. - **trg.mbox.to (String)**: Enter the mailbox recipient. - **trg.mbox.from (String)**: Enter the mailbox sender. - **trg.mbox.subject (String)**: Enter the email’s subject line. - **trg.mbox.body (String)**: Enter the body of the email in plain text format. - **trg.mbox.htmlbody (String)**: Enter the body of the email in HTML format. - **trg.mbox.attachment (Binary)**: Upload an email file attachment. - **trg.mbox.fulltext (String)**: Enter the full text contents of the email. - **trg.mbox.filename (String)**: Enter a single filename for the email. - **trg.mbox.filename (StringArray):**Enter a StringArray of filenames representing email file attachments. - Click the **SAVE**button. NoteYou can also configure each option by toggling the **Upload** slider on and then uploading a JSON file. ### Timer Trigger Create a new Run Profile as described in the [“Creating Run Profiles”](/docs/playbooks-run-profiles#creating-run-profiles) section, select **Timer** as the **Type**, and click the **NEXT**button. The **Configure**section will be displayed (Figure 8). ![Figure 8_Playbooks - Run Profiles_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%208_Playbooks%20-%20Run%20Profiles_7.7.1.png) - **trg.timer.timestamp (String)**: Enter the timestamp in ISO 8601 format. Alternatively, toggle the **Upload** slider on to upload a JSON file containing the timestamp. - Click the **SAVE**button**.** ### WebHook Trigger Create a new Run Profile as described in the [“Creating Run Profiles"](/docs/playbooks-run-profiles#creating-run-profiles) section, select **WebHook** as the **Type**, and click the **NEXT**button. The **Configure**section will be displayed (Figure 9). ![Figure 9_Playbooks - Run Profiles_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%209_Playbooks%20-%20Run%20Profiles_7.7.1.png) - **Method (String)**: Enter the HTTP method that will be used when the WebHook Trigger is called. Acceptable values include **GET**, **PUT**, **POST**, **DELETE**, **OPTIONS**, and **HEAD**. - **Query Param (KeyValueArray)**: Enter a key/value pair of query parameters that will be sent to the HTTP request when the WebHook Trigger is called. Alternatively, toggle the **Upload** slider on to upload a JSON string with an array of key/value pairs. - **Header (KeyValueArray)**: Enter a key/value pair of header parameters that will be sent to the HTTP request when the WebHook Trigger is called. Alternatively, toggle the **Upload** slider on to upload a JSON string with an array of key/value pairs. - **Body (String)**: Enter string content used during POST and PUT calls to the WebHook Trigger. Alternatively, toggle the **Upload** slider on to upload a JSON file containing the string content. - **Body (Binary)**: Upload binary content used during POST and PUT calls to the WebHook Trigger. - Click the **SAVE**button. ## Executing a Playbook Using a Run Profile To execute an active Playbook using a Run Profile, open the Playbook in the **Playbook Designer**and click the **Run Playbook**![Run%20Playbook%20with%20Run%20Profile%20icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Run%20Playbook%20with%20Run%20Profile%20icon.png)icon displayed on the Playbook’s Trigger (Figure 10). A list of available Run Profiles matching the Trigger type will be displayed. If no available Run Profiles match the Trigger type, click **Create Profile** to create a new Run Profile. See the [“Creating Run Profiles"](/docs/playbooks-run-profiles#creating-run-profiles) section for more information. ![Figure 10_Playbooks - Run Profiles_7.7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%2010_Playbooks%20-%20Run%20Profiles_7.7.1.png) For more information about Playbook executions, see [*Playbooks Executions*](https://knowledge.threatconnect.com/docs/playbook-executions). --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20113-01 v.01.E ## Related - [Executing a Playbook](/executing-a-playbook.md) - [Parts of a Playbook](/parts-of-a-playbook.md) - [Playbook Executions](/playbook-executions.md) - [The Mailbox Trigger](/playbooks-the-mailbox-trigger.md) - [The Playbook Designer](/the-playbook-designer.md) - [The Timer Trigger](/playbooks-the-timer-trigger.md) - [The UserAction Trigger](/the-useraction-trigger.md) - [The WebHook Trigger](/the-webhook-trigger.md)