> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/orchestration-soar-beta/playbooks/add-playbook.md). # Add Playbook {% hint style="warning" %} **Please note**: This view is currently in **Beta status**. User interface and functionalities can change at any time. This view is only visible if you have enabled the **Enable beta features** option under **Settings** → [User Account](/docs/manual/english/administration/settings/user-account.md). {% endhint %} *** Click **Add Playbook** in the upper-right corner of the [playbook overview](/docs/manual/english/platform-usage/siem/orchestration-soar-beta/playbooks.md#playbooks-overview) to create a new playbook. The **Add Playbook** window opens.

The following options are available:

Option	Description
Name	Enter a meaningful name for the playbook.
Description	Provide a more detailed description of the playbook. This field is optional.
Enabled	Allow the playbook to actively correlate data and initiate automated processes. This option is enabled by default. Select or deselect the checkbox next to Enabled to enable or disable the playbook.

Option

Description

Name

Enter a meaningful name for the playbook.

Description

Provide a more detailed description of the playbook.

This field is optional.

Enabled

Allow the playbook to actively correlate data and initiate automated processes.

This option is enabled by default.

Select or deselect the checkbox next to Enabled to enable or disable the playbook.

Click **Close** to return to the list view. After configuring all settings, click **Apply** to create a new playbook. The **SIEM** → **Orchestration (SOAR)** → **Playbooks** → **Add** view opens. The playbook looks like the following at first:

After configuring all settings, click **Add Playbook** to save and create the new playbook. Click **Back** to return to the list overview. {% hint style="danger" %} **Please note**: If you leave this view without saving, all configured settings will be lost and cannot be recovered. {% endhint %} *** ## Customizing the Playbook View You can customize the playbook view in several ways.

Click the **Zoom In** icon in the upper-right corner of the canvas to zoom in, or click the **Zoom Out** icon to zoom out. Alternatively, use your mouse wheel to adjust the view. Click the **Fit View** icon in the upper-right corner of the canvas to scale the view automatically so that all components of the playbook are centered on the canvas. Click and hold the dark area in the **Canvas Preview** in the upper-right corner to move the visible section to the required position. ### Placing Widgets You can place widgets anywhere in the editing area. Click and hold a [function block](#function-blocks) with the left mouse button to insert the corresponding block as a widget anywhere on the canvas.

Click and hold a widget with the left mouse button to move and reposition it using drag and drop.

### Connecting Widgets To create one or more specific process paths within a playbook, you must connect widgets with each other. The connections determine how information is processed further. Each widget has an **input point** at the top and at least one **output point** at the bottom. The entry point and endpoint widgets are exceptions.

Hover over an output point on a widget until the cursor changes to a **Plus** icon . Then click the **output point** with the left mouse button and, while holding the button, drag a connection to an **input point** on another widget.

Hover over the connection line between two widgets until a **Delete** icon appears. Click it to remove the corresponding connection.

### Actions for Widgets Hover over a widget on the canvas to show all actions which are available for that widget.

The following options are available:

Option	Description
Edit	Click the Edit icon to configure the widget according to its function.
Copy	Click the Copy icon to duplicate the widget together with all configured settings. The duplicated widget appears below the existing widget.
Delete	Click Delete to delete the corresponding widget. Please note: Deleted widgets cannot be recovered.

*** ## Left Sidebar On the left sidebar, you can configure [general settings](#general-settings) and select [function blocks](#function-blocks) that allow you to create custom response processes.

### General Settings

Option	Description
Name	Shows the custom name of the playbook. Click the Edit icon to change the name of the playbook.
Revision	Shows the unique revision identifier for the current version of the playbook. This row is empty when a new playbook is created.

Option

Description

Name

Shows the custom name of the playbook.

Click the Edit icon to change the name of the playbook.

Revision

Shows the unique revision identifier for the current version of the playbook.

This row is empty when a new playbook is created.

### Function Blocks The following blocks are available for different functions:

Function Block	Description
Context (Context)	Select fields by which incoming logs can be grouped automatically and then processed further. An inserted context block appears as a Context widget on the canvas.
Filter (Data Manipulation)	Define filter rules to exclude data from further processing based on specific conditions. An inserted filter block appears as a Filter widget on the canvas.
Decision (Data Manipulation)	Define conditions to enable different process paths based on the context. An inserted decision block appears as a Decision widget on the canvas.
Action (Actions)	Define rules for an action that is executed when a specific condition occurs. An inserted action block appears as an Action widget on the canvas.
LLM (Actions)	Use a connected LLM (Large Language Model) provider and define prompts to perform AI-based actions and analyses. An inserted LLM block appears as an LLM widget on the canvas.
Notification (Actions)	Create an email template for automated notifications. An inserted notification block appears as a Notification widget on the canvas.

*** ## Creating a Playbook ### Widget: Entry Point Here you define a trigger for your playbook. {% hint style="danger" %} **Please note**: Selecting an entry point is mandatory and is required before you can add further [function blocks](#function-blocks) to the playbook. After adding an entry point, only a [Context widget](#tile-context) can be added as the next block. {% endhint %}

Click **Select Trigger** in the entry point widget to open a new window where you can configure the playbook's starting point.

The following option is available:

Option	Description
Workflow	Select a workflow that serves as the starting condition for the playbook. The subsequent playbook steps take effect only after the workflow is triggered. Click the Workflow field to expand a list of all available workflows, then select a workflow. Alternatively, use the free-text input to find workflows in the list more quickly.

Option

Description

Workflow

Select a workflow that serves as the starting condition for the playbook. The subsequent playbook steps take effect only after the workflow is triggered.

Click the Workflow field to expand a list of all available workflows, then select a workflow. Alternatively, use the free-text input to find workflows in the list more quickly.

After you select a workflow, the selected starting condition is shown as a preview below the **Workflow** field. Click **Apply** to add the selected workflow as the starting condition. *** ### Widget: Context A context widget can only be added to the playbook after you defined an [entry point](#tile-entry-point). Click the **Edit** icon next to a context widget to open a new window where you can configure the context.

Click the **Context** field to enter a meaningful display name for the context widget. Click **Add Variable** to open a section with additional input fields. Here you can select a field by which incoming logs can, for example, be grouped automatically and then processed further.

The following options are available:

Option	Description
Field Name	Select a field by which incoming logs should be grouped. Click the Field Name field to expand a list of all available field names, then select a field. Alternatively, use the free-text input to find fields in the list more quickly.
Variable Name	Enter a name for the grouping. By default, the variable name is the same as the field name.
Aggregator	This field is only visible if you select Secondary Variable. Define how field values should be aggregated and displayed. Depending on the data type of the selected metric, not all aggregators are useful or available. Numeric fields are suitable for calculations such as averages or sums, while text fields can generally be used only for minimum and maximum values. Click the Aggregator field to expand a list of all available options. The following options are available: Array: All available measured values are taken into account. Set: Only measured values that are distinct from each other are taken into account.
Primary Variable	Define that the previously selected field should be a primary field. The playbook uses primary fields to group incoming logs automatically when the corresponding field values match. This option is selected by default.
Secondary Variable	Define that the previously selected field should be a secondary field. Secondary fields are not used to group incoming logs. They are used only to enrich the context with additional information. This option is not selected by default.

Click **Apply** to add the field as a context variable.

You now have the following additional options:

Action	Description
Adding Another Context Variable	Click Add Variable to select another field by which incoming logs should be grouped.
Sorting Context Variables	Click the Grid icon to the left of a context variable and drag it to any position in the list while holding the mouse button to change the grouping order.
Deleting Context Variables	Click the Delete icon to the right of a context variable to remove it from the list.
Applying Settings	Click Apply to save your settings and return to the canvas.
Cancelling	Click Abort to return directly to the canvas without saving. Please note: If you leave this view without clicking Apply, all configured settings will be permanently lost.

*** ### Widget: Filter A filter widget can be added to the playbook only after you defined an [entry point](#tile-entry-point) and configured a [context widget](#tile-context). Click the **Edit** icon next to a filter widget to open a new window where you can configure the filter to exclude data from further processing based on specific conditions.

Click the **Filter** field to enter a meaningful display name for the filter widget. Click **Requirement** to open a section with additional input fields where you can define different filter conditions. Two or more conditions can be connected using the **AND** or **OR** operator. You can also click **Sub Requirement** to add a subcondition to a condition. {% hint style="info" %} Requirements and subrequirements can be nested. They are displayed graphically as a hierarchical condition tree. {% endhint %} Click the **Delete** icon next to an added condition or subcondition to remove it from the condition tree.

The following options are available:

Option	Description
Operator	Define how you want to connect two or more conditions. The following operators are available: AND: All conditions must be met. OR: At least one condition must be met.
Context Variable	This field is only visible when you add a Requirement or Sub Requirement. Select a previously created context variable, meaning a field grouping, on which you want to base a filter rule. Click the Context Variable field to expand a list of all available context variables, then select a variable. Alternatively, use the free-text input to find variables in the list more quickly.
Operator	This field is visible only when you add a Requirement or Sub Requirement and assign a Context Variable to it. Select an operator for the field value that you will define in the following to filter out irrelevant values accordingly. Click the Operator field to expand a list of all available operators, then select one. The available operators may vary depending on the field on which the selected context variable is based. The following operators can be available: Greater Than: All logs in which the value of the field defined as the context variable is greater than the value defined in the following are retained and processed further. Greater Than or Equal: All logs in which the value of the field defined as the context variable is equal to or greater than the value defined below are retained and processed further. Smaller Than: All logs in which the value of the field defined as the context variable is less than the value defined in the following are retained and processed further. Smaller Than or Equal To: All logs in which the value of the field defined as the context variable is equal to or less than the value defined in the following are retained and processed further. Equal: All logs in which the value of the field defined as the context variable matches the value defined in the following are retained and processed further. Unequal: All logs in which the value of the field defined as the context variable does not match the value defined below are retained and processed further. Regular Expression: All logs in which the value of the field defined as the context variable matches the pattern defined in the following are retained and processed further.
Value	This field is visible only if you select Equal or Unequal in the Operator field. Define a field value for the field defined as the context variable to exclude irrelevant logs according to the previously selected operator. Values can, for example, be numbers or Boolean values (true or false).
Pattern (Regex) (Syntax: RE2)	This field is visible only if you select Regular Expression in the Operator field. Enter a regular expression using RE2 syntax to exclude irrelevant logs according to the specified pattern. RE2 syntax refers to Google's RE2 regular expression engine. Click the Flag icon at the end of an input field to open the Regex Flags window. Here you can configure settings for your regular expression.

The following options are available:

Option	Description
Multiline	Define whether the beginning and end of lines should be detected in multiline text. This option is disabled by default. Select or deselect the checkbox next to Multiline to enable or disable the option.
Case Insensitive	Define whether capitalization should be ignored. This option is disabled by default. Select or deselect the checkbox next to Case Insensitive to enable or disable the option.

Option

Description

Multiline

Define whether the beginning and end of lines should be detected in multiline text.

This option is disabled by default.

Select or deselect the checkbox next to Multiline to enable or disable the option.

Case Insensitive

Define whether capitalization should be ignored.

This option is disabled by default.

Select or deselect the checkbox next to Case Insensitive to enable or disable the option.

*** ### Widget: Decision A decision widget can be added to the playbook only after you defined an [entry point](#tile-entry-point) and configured a [context widget](#tile-context). Click the **Edit** icon next to a decision widget to open a new window where you can configure an if-else condition to enable different context-based process paths.

Click the **Decision** field to enter a meaningful display name for the decision widget. Click **Add Decision** to create a new decision path. {% hint style="info" %} For every decision you add, the decision widget on the canvas receives an additional output point for another [widget connection](#connect-tiles), allowing you to define separate process paths. {% endhint %}

Click the **Condition Label (Optional)** field to enter a meaningful display name for the condition. Click **Requirement** to open a section with additional input fields where you can define different filter conditions. Two or more conditions can be connected using the **AND** or **OR** operator. You can also click **Sub Requirement** to add a subcondition to a condition. {% hint style="info" %} Conditions and subconditions can be nested. They are displayed graphically as a hierarchical condition tree. {% endhint %} Click the **Delete** icon next to an added condition or subcondition to remove it from the condition tree.

The following options are available:

Option	Description
Operator	Define how you want to connect two or more conditions. The following operators are available: AND: All conditions must be met. OR: At least one condition must be met.
Context Variable	This field is only visible when you add a Requirement or Sub Requirement. Select a previously created context variable, meaning a field grouping, on which you want to base a filter rule. Click the Context Variable field to expand a list of all available context variables, then select a variable. Alternatively, use the free-text input to find variables in the list more quickly.
Operator	This field is visible only when you add a Requirement or Sub Requirement and assign a Context Variable to it. Select an operator for the field value that you will define in the following to filter out irrelevant values accordingly. Click the Operator field to expand a list of all available operators, then select one. The available operators may vary depending on the field on which the selected context variable is based. The following operators can be available: Greater Than: All logs in which the value of the field defined as the context variable is greater than the value defined in the following are retained and processed further. Greater Than or Equal: All logs in which the value of the field defined as the context variable is equal to or greater than the value defined below are retained and processed further. Smaller Than: All logs in which the value of the field defined as the context variable is less than the value defined in the following are retained and processed further. Smaller Than or Equal To: All logs in which the value of the field defined as the context variable is equal to or less than the value defined in the following are retained and processed further. Equal: All logs in which the value of the field defined as the context variable matches the value defined in the following are retained and processed further. Unequal: All logs in which the value of the field defined as the context variable does not match the value defined below are retained and processed further. Regular Expression: All logs in which the value of the field defined as the context variable matches the pattern defined in the following are retained and processed further.
Value	This field is visible only if you select Equal or Unequal in the Operator field. Define a field value for the field defined as the context variable to exclude irrelevant logs according to the previously selected operator. Values can, for example, be numbers or Boolean values (true or false).
Pattern (Regex) (Syntax: RE2)	This field is visible only if you select Regular Expression in the Operator field. Enter a regular expression using RE2 syntax to exclude irrelevant logs according to the specified pattern. RE2 syntax refers to Google's RE2 regular expression engine. Click the Flag icon at the end of an input field to open the Regex Flags window. Here you can configure settings for your regular expression.

Click **Add Decision** to create another decision path (**if-else**). {% hint style="warning" %} **Please note**: Decisions are evaluated in the order in which they were created. {% endhint %}

Configure all settings as previously described. Click the **Delete** icon next to an added decision to remove it.

---------------

Click **Apply** to save your settings and return to the canvas. Click **Abort** to return directly to the canvas without saving. {% hint style="danger" %} **Please note**: If you leave this view without clicking **Apply**, all configured settings will be permanently lost. {% endhint %} *** ### Widget: Action An action widget can be added to the playbook only after you defined an [entry point](#tile-entry-point) and configured a [context widget](#tile-context). Click the **Edit** icon next to an action widget to open a new window where you can configure an action that is executed when a specific condition occurs.

Click the **Action** field to enter a meaningful display name for the action widget. You can choose between two actions: * [Action 1: Webhook](#action-1-webhook) * [Action 2: Identity Provider](#action-2-identity-provider) #### Action 1: Webhook Click **Webhook** to open a section with additional input fields.

The following options are available:

Option	Description
Method	Select the HTTP method used to send the request to the target URL. The default HTTP method is POST. Click the Method field to expand a list of all available options. The following options are available: GET: Retrieves data from the target system. POST: Creates new data in the target system or sends data to the target system. PATCH: Partially updates existing data in the target system. PUT: Fully updates existing data in the target system. DELETE: Deletes existing data from the target system.
Base URL	Enter the target URL to which the webhook request should be sent.
HTTP Header Name	Enter the name of an HTTP header that you want to send to the target URL as additional information.
Value	Enter the corresponding value for the HTTP header defined above.
Body Variables	Shows all available variables that you can use in the Request Body field, together with their corresponding placeholders. Please note: The available variables vary depending on the context to which the action is assigned within a process path. Click and hold the Grid icon next to a placeholder with the left mouse button, then drag and drop the placeholder anywhere into the Request Body field.

Click **Add HTTP Header** to add additional HTTP headers. Click the **Delete** icon to the right of an added HTTP header to remove it.

---------------

**Request Body** Here you can define the content of the HTTP request that should be sent to the target URL. {% hint style="info" %} Use the available placeholders from the **Body Variables** section here as required. {% endhint %}

#### Action 2: Identity Provider Click **Identity Provider** to open a section with additional input fields.

The following options are available:

Option	Description
Identity Provider	Define the directory service that the action applies to. Please note: To be able to select a directory service here, you must first add it under SIEM → Advanced Settings → Identity Provider. Click the Identity Provider field to expand a list of all available directory services, and select an identity provider from the list.
Action	Define the action to be executed. The default action is Block User. Click the Action field to expand a list of all available options. The following options are available: Block User: Block specific users connected via the selected directory service. Unblock User: Unblock specific users connected via the selected directory service.

Option

Description

Identity Provider

Define the directory service that the action applies to.

Please note: To be able to select a directory service here, you must first add it under SIEM → Advanced Settings → Identity Provider.

Click the Identity Provider field to expand a list of all available directory services, and select an identity provider from the list.

Action

Define the action to be executed.

The default action is Block User.

Click the Action field to expand a list of all available options.

The following options are available:

Block User: Block specific users connected via the selected directory service.
Unblock User: Unblock specific users connected via the selected directory service.

---------------

Click **Apply** to save your settings and return to the canvas. Click **Abort** to return directly to the canvas without saving. {% hint style="danger" %} **Please note**: If you leave this view without clicking **Apply**, all configured settings will be permanently lost. {% endhint %} *** ### Widget: LLM An LLM widget can be added to the playbook only after you defined an [entry point](#tile-entry-point) and configured a [context widget](#tile-context). Click the **Edit** icon next to an LLM widget to open a new window where you can select an LLM provider and define prompts for AI-based actions.

Click the **LLM** field to enter a meaningful display name for the LLM widget. The following additional options are available:

Option	Description
LLM Provider	Select the LLM provider that you want to use. Please note: Before you can select an LLM provider here, you must add it under SIEM → Orchestration (SOAR) → LLM Providers. Click the LLM Provider field to expand a list of all available LLM providers, then select a provider. Alternatively, use the free-text input to find LLM providers in the list more quickly. Click the Remove icon next to a selected LLM provider to remove it from the LLM Provider field.
Summary	Select this option to have the LLM summarize incoming logs based on context. This option is selected by default.
Decision	Select this option to have the LLM assign incoming logs to different processing paths based on context. If you select Decision, an additional section opens with input fields where you can configure additional settings.
Custom	Select this option to have the LLM analyze incoming logs or formulate problem statements based on context and a custom instruction.
Additional Prompt	This field is only visible if you selected Summary or Decision above. Enter additional instructions that the LLM should take into account when summarizing logs or making a decision.
Prompt	This field is only visible if you selected Custom above. Enter a custom prompt that the LLM should follow.
Show Chain-of-Thoughts	Enable this option to display the LLM's reasoning, including all intermediate steps, for improved traceability. This option is enabled by default. Select or deselect the checkbox next to Show Chain-of-Thoughts to enable or disable the option.
Enable Tool Calls	Enable this option to allow the LLM to access external sources such as websites or databases for more precise responses. This option is disabled by default. Select or deselect the checkbox next to Enable Tool Calls to enable or disable the option.

Click the **Delete** icon next to an added decision to remove it. #### Decisions This section is only visible if you selected **Decision** above. Here you can define the specific decisions that the LLM should make.

The following options are available:

Option	Description
Label	Enter a meaningful name for the decision path.
Decision Criterion	Enter a precise description of the condition under which the LLM should make this decision.

Click **Add Decision** to define another decision path. {% hint style="info" %} For every decision you add, the LLM widget on the canvas receives an additional output point for another [widget connection](#connect-tiles), allowing you to define separate process paths. {% endhint %} Click the **Delete** icon next to an added decision to delete the corresponding decision path. #### Advanced Settings This section is only visible if you selected **Decision** above. Here you can configure additional settings that control the LLM's response.

The following options are available:

Option	Description
Default Action	Select the decision path that should be used if the LLM does not return a response within the defined time limit. The default Default Action is the ID of the first decision that was created. Click the Default Action field to expand a list of all available decision paths, then select a decision path.
Timeout	Define the time limit in seconds within which the LLM must return a response. If the time limit is exceeded, the decision path defined in the Default Action field is executed. The default time limit is 60 seconds. Click the Timeout field and use to increase or to decrease the value. Alternatively, enter a number manually and press Enter to confirm your input.

Option

Description

Default Action

Select the decision path that should be used if the LLM does not return a response within the defined time limit.

The default Default Action is the ID of the first decision that was created.

Click the Default Action field to expand a list of all available decision paths, then select a decision path.

Timeout

Define the time limit in seconds within which the LLM must return a response.

If the time limit is exceeded, the decision path defined in the Default Action field is executed. The default time limit is 60 seconds.

Click the Timeout field and use to increase or to decrease the value. Alternatively, enter a number manually and press Enter to confirm your input.

---------------

Click **Apply** to save your settings and return to the canvas. Click **Abort** to return directly to the canvas without saving. {% hint style="danger" %} **Please note**: If you leave this view without clicking **Apply**, all configured settings will be permanently lost. {% endhint %} *** ### Widget: Notifications A notification widget can be added to the playbook only after you defined an [entry point](#tile-entry-point) and configured a [context widget](#tile-context). Click the **Edit** icon next to a notification widget to open a new window where you can configure an email template for automated notifications.

Click the **Notification** field to enter a meaningful display name for the notification widget. The following additional options are available:

Option	Description
Subject	Enter a meaningful subject for the email template that accurately describes the content of the notification.
Body (Markdown + Mustache)	Enter the content of the notification. The text can be formatted using Markdown. Use the available placeholders from the Body Variables section here as required.
Body Variables	Shows all available Mustache variables that you can use in the Body (Markdown + Mustache) field, together with their corresponding placeholders. Click and hold the grid icon next to a placeholder with the left mouse button, then drag and drop the placeholder anywhere into the Body (Markdown + Mustache) field.

Option

Description

Subject

Enter a meaningful subject for the email template that accurately describes the content of the notification.

Body (Markdown + Mustache)

Enter the content of the notification.

The text can be formatted using Markdown. Use the available placeholders from the Body Variables section here as required.

Body Variables

Shows all available Mustache variables that you can use in the Body (Markdown + Mustache) field, together with their corresponding placeholders.

Click and hold the grid icon next to a placeholder with the left mouse button, then drag and drop the placeholder anywhere into the Body (Markdown + Mustache) field.

Click **Minimal Template** to the right of the **Subject** field to show a minimal email body template with pre-inserted placeholders in the **Body (Markdown + Mustache)** field. {% hint style="warning" %} **Please note**: The available Mustache variables vary depending on the [context](#widget-context) to which the notification is assigned within a process path. {% endhint %}

Click **Preview** to the right of the **Subject** field to show a preview of the email body. #### Notification Channels Here you can define who should receive notifications based on the corresponding email template.

The following options are available:

Option	Description
Type	Shows the communication channel through which the notification should be sent. Please note: Currently, notifications can be sent only by email.
Message Recipients	Select the recipient of the email notification. Click the Message Recipients field to expand a list of all available users, then select one or more users. Alternatively, use the free-text input to find users in the list more quickly. Click the Remove icon next to an added user to remove the user from the Message Recipients field.

Option

Description

Type

Shows the communication channel through which the notification should be sent.

Please note: Currently, notifications can be sent only by email.

Message Recipients

Select the recipient of the email notification.

Click the Message Recipients field to expand a list of all available users, then select one or more users. Alternatively, use the free-text input to find users in the list more quickly.

Click the Remove icon next to an added user to remove the user from the Message Recipients field.

Click **Add Channel** to show additional input fields where you can select another communication channel and recipient. Click the **Delete** icon next to an added notification channel to remove it.

---------------

Click **Apply** to save your settings and return to the canvas. Click **Abort** to return directly to the canvas without saving. {% hint style="danger" %} **Please note**: If you leave this view without clicking **Apply**, all configured settings will be permanently lost. {% endhint %} *** ### Widget: Exit Point The exit point widget marks the end of a process path in the playbook. Once the exit point is reached, processing for that path stops.

{% hint style="danger" %} **Please note**: The final widget in a process path within the playbook must always be the exit point widget to ensure that the playbook works correctly. {% endhint %} ***