> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/orchestration-soar-beta/playbooks.md).

# Playbooks

{% hint style="warning" %}
**Please note**: This view is currently in **Beta status**. User interface and functionalities can change at any time.

<i class="fa-eye">:eye:</i> This view is only visible if you have enabled the **Enable beta features** option under **Settings** → [User Account](/docs/manual/english/administration/settings/user-account.md).
{% endhint %}

***

Playbooks allow you to orchestrate and automate more complex response processes for security-relevant incidents, using workflows as incident triggers.

***

<i class="fa-compass">:compass:</i> Navigate to **SIEM** → **Orchestration (SOAR)** → **Playbooks** to show a list of all configured playbooks. If you have not created a playbook yet, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfcYcWOPukRyZcAHSCifM%2FEnginsight-EN-SIEM-Playbooks-List-Full.jpg?alt=media&amp;token=d6d98fc4-4539-46b1-818d-78feca1d93d7" alt=""><figcaption></figcaption></figure>

The [playbook overview](#playbooks-overview) provides information such as:

* when a playbook was created and last modified.
* whether a playbook is active or inactive.

You can also [add new playbooks](#add-playbook).

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

### Deleting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a list item to select the corresponding item. Alternatively, select the checkbox in the table header to select all list items.

The number of selected list entries is now displayed next to the search field.

The **Delete** button <i class="fa-trash">:trash:</i> also appears in the upper-right corner. Click it, then confirm the message that appears by clicking **Delete**.

{% hint style="danger" %}
**Please note:** Deleted items cannot be restored.
{% endhint %}

***

## Playbooks: Overview

The playbook overview is structured as a table.&#x20;

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FTB5NvTcg8MJ3V779Bl08%2FEnginsight-EN-SIEM-Playbooks-List-Overview.jpg?alt=media&amp;token=9ed751ca-756e-4f86-8e3d-555c6b5644a8" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="199.70703125">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td><p>Shows the custom name of the playbook and an additional description, if provided. The date and time it was created and the date and time it was last edited are also shown.<br></p><p>A unique revision identifier for the current version of the playbook is also shown.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a playbook to navigate to the respective <a href="#playbook-edit-view">edit view</a>. There, you can adjust the configured settings and delete the playbook.</p></td></tr><tr><td>Enabled</td><td>Shows whether the corresponding playbook is active and therefore actively correlates data and initiates automated processes.<br><br>An enabled playbook is indicated by a green <strong>check</strong> icon <i class="fa-circle-check" style="color:$success;">:circle-check:</i>. Disabled playbooks are indicated by a red <strong>circle</strong> icon <i class="fa-circle" style="color:red;">:circle:</i>.</td></tr></tbody></table>

***

## Adding a Playbook

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-plus">:plus:</i> **Add Playbook** in the upper-right corner to [create a new playbook](/docs/manual/english/platform-usage/siem/orchestration-soar-beta/playbooks/add-playbook.md).

***

## Playbook: Edit View

<i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a playbook to navigate to the respective edit view.

The playbook edit view consists of two views that can be accessed using tabs:

* [Tab: Playbook](#tab-playbook)
* [Tab: Flows](#tab-flows)

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2Fz5LMRVZZvg9mOA4Wcp4Y%2FEnginsight-EN-SIEM-Playbook-Full.jpg?alt=media&amp;token=da014974-fb58-4ec4-b133-1b8dcfb33949" alt=""><figcaption></figcaption></figure>

### Tab: Playbook

Here you can adjust the playbook configuration or delete the playbook.

The following actions are available:

<table><thead><tr><th width="200.39453125">Option</th><th>Description</th></tr></thead><tbody><tr><td>Save Changes</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Save Changes</strong> after adjusting any settings.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note:</strong> Unsaved changes cannot be recovered.</p></div></td></tr><tr><td>Back</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Back</strong> to return to the list overview.</td></tr><tr><td>Remove</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Remove</strong>, then confirm the prompt that appears to delete the object that you are editing.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note:</strong> Deleted objects cannot be recovered.</p></div></td></tr></tbody></table>

### Tab: Flows

Here you can view details about runs of the corresponding playbook.

{% hint style="info" icon="eye" %}
**Please note**: The user interface and operation of this view correspond to the **SIEM** → **Orchestration (SOAR)** → [Flows](/docs/manual/english/platform-usage/siem/orchestration-soar-beta/flows.md) menu item. For this reason, the view is not described in detail here.
{% endhint %}

***