Playbooks

The Playbooks Screen

This article describes the functionalities available on the Playbooks screen, which lists all Playbooks, including Playbook Components, available on your ThreatConnect instance.

Updated on : 20 May 2023

The Playbook Designer

Contains articles describing how to use the Playbook Designer, including the functionalities available on the Playbook Designer screen and instructions on building, configuring, and activating Playbooks.

2 Articles in this category

Parts of a Playbook

This article describes each Trigger, App, and Operator type (the main building blocks of Playbooks in ThreatConnect) and provides links to articles that contain more detailed information.

Updated on : 09 May 2023

Triggers

Contains articles describing the Mailbox, Timer, UserAction, and WebHook Triggers available for use in Playbooks.

4 Articles in this category

Apps and Operators

Contains articles describing specific Apps and Operators for use in Playbooks.

2 Articles in this category

Playbook Components

Contains articles describing how to create, edit, clone, and administrate Playbook Components and how to use a Component in a Playbook in ThreatConnect.

6 Articles in this category

Executing a Playbook

This article describes how to execute Playbooks that use Mailbox, Timer, UserAction, WebHook, Group, Indicator, Case, Track, and Victim Triggers.

Updated on : 12 Apr 2023

Playbook Executions

This article describes how to view the details and logs for a Playbook execution, view an active Playbook execution in the Execution Graph pane, and stop (or kill) a Playbook execution.

Updated on : 03 Nov 2022

Playbooks: Run Profiles

Run Profiles represent the data type or event needed to execute a Playbook without navigating away from the Playbook Designer. This article describes how to view, manage, and create Run Profiles and execute a Playbook using a Run Profile.

Updated on : 19 Oct 2022

Playbook Versions

This article explains how major and minor version numbering works, discusses how to view version history, and describes how to create new major and minor versions of a Playbook or Component.

Updated on : 25 Oct 2022

Playbook Templates

This article describes how to view, search for, install and delete Playbook Templates. It also describes how to import a Template as a Playbook.

Updated on : 25 Oct 2022

Playbooks: Return on Investment

Playbooks ROI enables ThreatConnect users to view and visualize the return on investment for the Playbooks executed in their Organization. This article describes how to configure and view ROI for a Playbook and access ROI dashboard metrics.

Updated on : 08 Sep 2022

Multi-Environment Orchestration: Executing Playbook Apps Through a Firewall

This article describes how to configure remote execution for Playbook Apps and Service Triggers in ThreatConnect.

Updated on : 22 Nov 2022

Playbook Environments

Contains articles describing the Playbook Environments screen in ThreatConnect, including how to view, activate, manage, configure, and administer an Environment.

4 Articles in this category

Playbook Activity

This article discusses functionality available on the Playbooks Activity screen, which is a control panel on which Organization Administrators can monitor Playbook Server and Worker execution metrics, priorities, and processes.

Updated on : 25 Oct 2022

Playbook Services

This article describes the function of Playbook Services Apps, which are microservices that constantly run in the background. It also describes how to create, view, and use Services.

Updated on : 28 Apr 2023

Playbooks Glossary

This glossary consists of the terminology used within ThreatConnect’s Playbooks feature and its various screens. For a complete list of Playbook Apps available in ThreatConnect, visit the ThreatConnect Marketplace.

Updated on : 19 Oct 2022