Playbooks are automated response workflows. By default, the **Playbooks** permission is set to **Disabled**. To set it to **Enabled**, you must first set **Scripts** to **Enabled**. When you enable **Playbooks**, you can then set **Cases and Issues** to View or View/Edit.
### Important
Playbooks are a prerequisite for the entire Investigation & Response workspace. You cannot set Cases and Issues to View/Edit unless Playbooks is Enabled.
Cortex XSIAM enforces least-privileged per-object access by allowing you to manage access for custom (user-defined) playbooks. For more information, see [Manage access to objects](../../../../../onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management#UUID-ff05f1c8-e516-ea74-9dff-ea8b26692754).
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enabled | <p>Users can browse the playbook library and are granted access depending on their per-object access and sub-permissions explained below. Some of the additional options can include:</p><ul><li>Create, edit, and delete playbooks</li><li>Enable/disable playbooks</li><li>Import and duplicate playbooks</li><li>Select a playbook on Issues</li><li>View the visual task-flow of a playbook</li><li>See the "Work Plan" within a case, when they have access to <strong>Cases and Issues</strong> (under <strong>Cases & Issues</strong>)</li></ul><p>When set to <strong>Enabled</strong>, you can grant the following additional permissions:</p><ul><li><strong>Create Playbooks</strong>: Enables all methods for adding playbooks to Cortex XSIAM. This includes the <strong>Build New Playbook</strong> button, as well as the ability to <strong>Duplicate</strong>, <strong>Attach</strong>, or <strong>Detach</strong> playbooks. The user who performs these actions is automatically designated as the <strong>Owner</strong>.</li><li><strong>Edit Public Playbooks</strong>: Allows the user to modify custom playbooks set to <strong>Public</strong>, even if they are not the Owner.</li><li><strong>Unlock</strong>: Enables unlocking playbooks locked by other users during concurrent editing and overrides the lock when another user is editing.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p><strong>Playbooks</strong> can only be <strong>Enabled</strong> when <strong>Scripts</strong> are <strong>Enabled</strong> first.</p></div> | <ul><li>SOC Tier-1 and 2 Analysts and Threat Hunters: Need visibility into playbooks but should not modify them.</li><li>SOC Tier 3 Analysts: Run playbooks on issues.</li><li>Security Engineer: Security Engineers need full playbook capabilities for advanced development.</li></ul> |
| Disabled | <p>Cannot access the Playbooks page, view any playbook configurations, see the playbook execution status (unless they access to the issue), and access the Workplan in cases/issues.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p><strong>Playbooks</strong> can only be <strong>Disabled</strong> after <strong>Cases and Issues</strong> (under <strong>Cases & Issues</strong>) are set to <strong>None</strong> first.</p></div> | |
**Required and recommended permissions**
To build a functional playbook, an engineer typically needs the following permissions:
| Permission | Permission Level | Reason |
| ---------------- | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Scripts | Enabled with checkboxes selected | Enabled with **Scripts** and **Create Scripts** selected. Most playbook tasks are actually scripts. You cannot configure the inputs/outputs of a task effectively without script visibility. |
| Integrations | View | Strongly Recommended. Required to see which external tools (e.g., VirusTotal, Slack, Active Directory) are available to be used as tasks. |
| Cases and Issues | View/Edit | Required to set playbook on issues (trigger playbooks). Otherwise set to view (minimum). Playbooks run on issues; Workplan needs all three permissions. |
| Action Center | View/Edit | Recommended. Since many playbooks execute remediation (e.g., Isolate), the Action Center is where those specific tasks are tracked and audited. |
| Playground | View/Edit | Recommended to test commands. |
| Dashboards | Enabled | Recommended. Dashboard events trigger playbook views. |