Playbook permissions ↗

Playbooks are automated response workflows. By default, the Playbooks permission is set to Disabled. To set it to Enabled, you must first set Scripts to Enabled. When you enable Playbooks, you can then set Cases and Issues to View or View/Edit.

Important

Playbooks are a prerequisite for the entire Investigation & Response workspace. You cannot set Cases and Issues to View/Edit unless Playbooks is Enabled.

Cortex XSIAM enforces least-privileged per-object access by allowing you to manage access for custom (user-defined) playbooks. For more information, see Manage access to objects.

Permission	Description	Roles Example
Enabled	<p>Users can browse the playbook library and are granted access depending on their per-object access and sub-permissions explained below. Some of the additional options can include:</p><ul><li>Create, edit, and delete playbooks</li><li>Enable/disable playbooks</li><li>Import and duplicate playbooks</li><li>Select a playbook on Issues</li><li>View the visual task-flow of a playbook</li><li>See the "Work Plan" within a case, when they have access to Cases and Issues (under Cases & Issues)</li></ul><p>When set to Enabled, you can grant the following additional permissions:</p><ul><li>Create Playbooks: Enables all methods for adding playbooks to Cortex XSIAM. This includes the Build New Playbook button, as well as the ability to Duplicate, Attach, or Detach playbooks. The user who performs these actions is automatically designated as the Owner.</li><li>Edit Public Playbooks: Allows the user to modify custom playbooks set to Public, even if they are not the Owner.</li><li>Unlock: Enables unlocking playbooks locked by other users during concurrent editing and overrides the lock when another user is editing.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Note</p><p>Playbooks can only be Enabled when Scripts are Enabled first.</p></div>	<ul><li>SOC Tier-1 and 2 Analysts and Threat Hunters: Need visibility into playbooks but should not modify them.</li><li>SOC Tier 3 Analysts: Run playbooks on issues.</li><li>Security Engineer: Security Engineers need full playbook capabilities for advanced development.</li></ul>
Disabled	<p>Cannot access the Playbooks page, view any playbook configurations, see the playbook execution status (unless they access to the issue), and access the Workplan in cases/issues.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Note</p><p>Playbooks can only be Disabled after Cases and Issues (under Cases & Issues) are set to None first.</p></div>

Required and recommended permissions

To build a functional playbook, an engineer typically needs the following permissions:

Permission	Permission Level	Reason
Scripts	Enabled with checkboxes selected	Enabled with Scripts and Create Scripts selected. Most playbook tasks are actually scripts. You cannot configure the inputs/outputs of a task effectively without script visibility.
Integrations	View	Strongly Recommended. Required to see which external tools (e.g., VirusTotal, Slack, Active Directory) are available to be used as tasks.
Cases and Issues	View/Edit	Required to set playbook on issues (trigger playbooks). Otherwise set to view (minimum). Playbooks run on issues; Workplan needs all three permissions.
Action Center	View/Edit	Recommended. Since many playbooks execute remediation (e.g., Isolate), the Action Center is where those specific tasks are tracked and audited.
Playground	View/Edit	Recommended to test commands.
Dashboards	Enabled	Recommended. Dashboard events trigger playbook views.