Build your playbook

Depending on your use case, you can use or customize a system playbook or develop a new playbook from scratch.

Developing a new playbook from scratch enables a tailored solution for your use case, whereas customizing a system playbook can save time, reduce complexity, and be a more efficient way to meet your organization's specific security and issue response needs.

The ability to create, edit, or share custom playbooks is governed by access management. If certain options are unavailable, contact your administrator. For more information, see [Manage access to playbooks and scripts](../../../onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management).

Follow these steps to build a playbook.

| Task | Description | See More |
| --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Task 1. Choose from existing playbooks or create your own | <p>Search for an out-of-the-box playbook to use, customize it, or create one based on your use case.<br>Use the <a href="accelerate-playbook-development-using-the-automation-engineer-agent-preview">Automation Engineer agent</a> to create, modify, and query playbooks (preview).</p> | See [Choose from existing playbooks or create your own](build-your-playbook/choose-from-existing-playbooks-or-create-your-own). |
| Task 2. Configure playbook settings | Define playbook settings, such as playbook triggers, inputs and outputs, and general settings. | See [Configure playbook settings](build-your-playbook/configure-playbook-settings). |
| Task 3. Add objects from the Task Library | The **Task Library** contains AI prompts, scripts, sub-playbooks, and tasks that enable you to communicate with end users, set conditions, and store relevant data. | See [Add objects from the Task Library](build-your-playbook/add-objects-from-the-task-library). |
| Task 4. Customize your playbook | Add scripts and sub-playbook loops, filtering and transforming data, extracting indicators, extending context, creating issue fields, polling, and more. | See [Customize your playbook](build-your-playbook/customize-your-playbook). |
| Task 5. Test your playbook | Set breakpoints, conditional breakpoints, skip tasks, and input and output overrides in the playbook debugger. | See [Test your playbook](build-your-playbook/test-your-playbook). |
| Task 6. Manage playbook content | Save versions of your playbook in Cortex XSIAM, or manage your playbook content development and testing using a remote repository. | See [Manage playbook content](build-your-playbook/manage-playbook-content). |

Sub-topics

• Choose from existing playbooks or create your own
• Configure playbook settings
• Add objects from the Task Library
  • Add commands and scripts
  • Add sub-playbooks
  • Add AI Prompt tasks
  • Add manual tasks and blank tasks
    • Create a standard task
    • Create a conditional task
    • Create a communication task
  • Create a section header
  • Configure script error handling in a playbook
• Customize your playbook
  • Configure a sub-playbook loop
  • Filter and transform Cortex XSIAM playbook data
  • Create custom filters and transformers
  • Filter considerations, categories, and built-in filters
  • Transformer considerations, categories, and built-in transformers
  • Extend context in playbooks
  • Extract indicators in playbooks
  • Update issue fields with playbook tasks
• Test your playbook
  • Troubleshoot playbook performance
• Manage playbook content