Creating Playbooks from Scratch

Create a playbook from scratch if you need to define playbooks for non-Web modules or you want a very precise query.

Step 1: Display the playbook screen

1. Click Automation.

2. Select a playbook type in the left pane:

• Web Playbook
• Social Media Playbook
• App Store Playbook
• Dark Web Playbook

3. Click Create from scratch.

If you don’t see the Get Started page shown above, use the New Playbook dropdown on the far right and select Blank playbook.

Step 2: Define the output

1. Assign a name to the playbook.
2. Select Findings under Please Select.
3. Select the attributes to include for each finding.
4. Select the output format.

5. Click Next.

Step 3: Define the query

1. Add one or more filters to define the scope of the query for this playbook.

For example, a weekly query of phishing threats that include the brand logo would include the following filters:

• Current Disposition – is – Phish
• First Seen – the last – 7 days
• Logo Detected – is – true

4. Click Next.

Step 4: Define the connector

1. Choose where you want to deliver playbook data.

Email is the default connector. You can enter multiple emails separated by a comma.

2. Click Next.

Step 5: Define the schedule

1. Select a start date and frequency.

2. Click Submit.