Playbook Templates🔗

The Templates tab displays all available playbook templates, which are used to create new playbooks. A single template can be used to create as many playbooks as needed.

Note

Each playbook has built-in documentation that walks through the steps to create a new playbook. Select Documentation from a playbook template or configured playbook in XDR to open this in a new tab and follow the guidance there.

Tip

Find a changelog of the most recently published playbook templates, actions, and connectors, as well as updates to existing templates and connectors on Automations Overview.

View Available Playbooks and Definitions🔗

Open the Templates tab to view all available playbook templates. You can view available templates in a table or in a grid of cards. More information is available in the table view; hover over any column heading to edit all displayed columns.

Start typing in the search bar to search for a template by name, or use the table filters to filter on various criteria.

Switching Between Playbook Template Views

View a Playbook Template’s Details🔗

The Playbook Template details page features definition information for the playbook template, including template steps, currently configured playbooks that use the template, and required connectors.

Template Steps🔗

The Template Steps tab illustrates the playbook's steps graphically. Take the following actions to interact with Template Steps:

Select a step to open its details and view code subsets.
Hover over a condition to display a tooltip with the full variable.
Expand or collapse a code segment with an iteration or branch by selecting the icon in the upper right corner.

Note

Download a playbook template if you wish to read the entire YAML file.

Playbooks🔗

Currently configured playbooks that use the template are listed here.

Dependencies🔗

Required connectors for playbook templates that have requirements are listed at the top of this section.

Tip

If a required connector is not yet configured, a warning symbol is displayed. Select Add New Connection for a shortcut to the Add a New Connection modal.

Playbook Template Required Connectors Tab

Playbook templates that support multiple connectors list these in the Supported Activities table of this section.

Built-in Playbook Documentation🔗

Each playbook template has built-in documentation that walks through the steps to create a new playbook. Select the Documentation tab from within a playbook template and follow the guidance there.

You can also access the documentation when configuring a playbook.

Create a Playbook🔗

Select Use this Template to start the Playbook configuration wizard and follow the prompts to complete the configuration. For detailed walkthroughs of various Automation configurations, see our Help Center's Automation section.

Important

Playbooks only allow you to configure options that are supported by the playbook template. Unsupported options are greyed out and cannot be configured.

Tip

The CEL Helper displays where applicable to provide common CEL expressions for use in automation configurations.

You can also use CEL Explorer to test CEL expressions against a specific type of input so that you can see the outcome of the expression while completing your configuration. For more information, see CEL Explorer.

Clone a Playbook Template🔗

To clone a playbook template:

Select the name of the desired template from the Templates tab of the Playbooks overview.
From the template details page, select More Actions > Clone.
In the clone modal that is displayed, enter a new name for the template. Names must be unique and can only contain letters (A-Z, a-z), numbers (0-9), and underscores ( _ ).
Select Clone.

Note

Secureworks global templates cannot be edited, so if you wish to adapt one, we advise cloning it first.

Important

Playbook templates cloned from Secureworks-managed templates will not be maintained or updated by Secureworks. We recommend using Secureworks-managed templates when possible.

Export a Playbook Template🔗

To export the playbook template as a YAML file:

Select the name of the desired template from the Templates tab of the Playbooks overview.
From the template details page, select More Actions > Export. The YAML file is downloaded.

Import a Playbook Template🔗

You can upload your own playbook templates using a YAML file.

Tip

Secureworks recommends starting from an existing template to ensure you have all the necessary fields in your file. Note, however, that not all fields are displayed when viewing the Template Steps tab, as this only shows the playbook steps portion of the file. Therefore, you need to download a template’s YAML file itself; see Export a Playbook Template for more information.

To import a playbook template:

Open the Templates tab of the Playbooks overview.
Select Import.
Choose the YAML file you wish to upload.

Deprecate a Playbook Template🔗

To deprecate an existing playbook template:

Select the name of the desired template from the Templates tab of the Playbooks overview.
From the template details page, select More Actions > Deprecate.
Provide a reason for deprecation.
Select Deprecate to confirm.

Templates that have been deprecated, as well as playbooks based on deprecated templates, display a warning banner.

Important

Deprecating a playbook template indicates that a better alternative exists. While not recommended, deprecated templates can still be used. Using the alternative is strongly encouraged.

Undeprecate a Playbook Template🔗

To undo playbook template deprecation:

Select the name of the desired template from the Templates tab of the Playbooks overview.
From the template details page, select More Actions > Undeprecate.
Select Undeprecate to confirm.