Automations

Automations leverage playbooks, Quick Actions, and agents to execute predefined workflows, use context data to make informed decisions, and interact with lists to store and retrieve information as needed during the automation process.

Sub-topics

• Automation in Cortex XSIAM
• Quick Actions
• Automation Exclusion Center
  • Manage automation exclusion policies
• Playbooks
  • Playbooks overview
  • Access to playbooks
  • Playbook development checkli
  • Plan your playbook
  • Manage playbooks
  • Build your playbook
    • Choose from existing playbooks or create your own
    • Configure playbook settings
    • Add objects from the Task Library
      • Add commands and scripts
      • Add sub-playbooks
      • Add AI Prompt tasks
      • Add manual tasks and blank tasks
        • Create a standard task
        • Create a conditional task
        • Create a communication task
      • Create a section header
      • Configure script error handling in a playbook
    • Customize your playbook
      • Configure a sub-playbook loop
      • Filter and transform Cortex XSIAM playbook data
      • Create custom filters and transformers
      • Filter considerations, categories, and built-in filters
      • Transformer considerations, categories, and built-in transformers
      • Extend context in playbooks
      • Extract indicators in playbooks
      • Update issue fields with playbook tasks
    • Test your playbook
      • Troubleshoot playbook performance
    • Manage playbook content
  • Accelerate playbook development using the Automation Engineer agent (preview)
    • Automation Engineer prompt examples
  • Best practices for playbooks
• Autonomous playbooks
  • Enable autonomous playbooks
  • Manage autonomous playbooks
  • Manage autonomous automation rules
  • Work Plan for autonomous playbooks
• AI Prompts
  • AI prompts role-based access control
  • Use existing prompts
  • Create a prompt
  • Write effective prompts
• Agentic Response (Preview)
• Create an automation rule
• Scripts
  • Access to scripts
  • Use existing scripts
  • Create a script
  • Accelerate script development using the Automation Engineer agent
  • Change the Docker image in an integration or script
• Context data
  • Issue context data
  • Case context data
  • Search context data
  • Add context data to an issue
  • Add context data to a case
  • Delete context data from a case
  • Use context data in a playbook
• Lists
  • Create a list
  • List commands
  • Use cases: JSON lists
    • Extract data from a JSON object
    • Extract a subset of the data
    • Filter extracted data
  • Transform a list into an array
• Jobs
  • Access to Jobs
  • Manage jobs
  • Create a time-triggered job
  • Create a job triggered by a delta in a feed