The Playbooks feature allows ThreatConnect® users to automate cyberdefense tasks via a drag-and-drop interface. Playbook Templates are Playbooks provided by ThreatConnect to illustrate best-in-class use cases for Playbooks to help educate users in how to construct more complex Playbooks.
On the top navigation bar (Figure 1), click Playbooks to display the Playbooks tab of the Playbooks screen (Figure 2).
Click on the Templates tab at the top left of the screen to display the Templates screen (Figure 3). Alternatively, hover the cursor over Playbooks on the top navigation bar (Figure 1) and select Templates from the dropdown menu that is displayed to navigate directly to the Templates screen.
The Templates screen displays a table containing all Templates available to the user, along with any associated labels and the date of the last update to the Template. Updates to Playbook Templates are available in the App Catalog. For more information, contact your System Administrator.
Searching for a Template
To search for a particular Template, enter a search string in the search bar at the top left of the screen. As letters are entered, the screen will narrow down the selections to ones containing the entered characters. In Figure 4, the string “wh” has narrowed down the results to three Templates.
Click the X at the end of the search bar to clear the search results.
Importing a Template
- To import a Template, click the vertical ellipsis icon at the far right of the row for that Template.
- Click the Import as Playbook option that is displayed (Figure 5).
- The Import Playbook window will be displayed with the Apps tab selected (Figure 6).
- Review the information for the Apps used by the Template, and then click the Next button. The Variables tab will be displayed (Figure 7).
- Some of the Apps in the Template may require values that can be created as variables during the import process. Entering the variables here is not necessary, but it is recommended to do so. When finished, click the IMPORT button. The imported Playbook will be displayed in inactive mode in the Playbook Designer (Figure 8). The Playbook will also be available for editing from the table of user-owned Playbooks on the Playbooks tab of the Playbooks screen.
NOTE: An unselected checkbox in the Installed column indicates that the required version of the corresponding App is not installed on the user’s instance. The Template import will not be able to proceed without installation of the App. Users should contact their System Administrator to request installation of the required version of the App.