Developing SOAR Playbooks (DSOARP)

Kursinhalt

• Automation best practices
• The visual playbook editor
• Using actions and decisions
• Using action results
• Testing and debugging playbooks
• User interaction
• Output formatting
• Complex logic
• Interacting with artifacts
• Using files in a playbook
• Custom lists
• Data filtering

Voraussetzungen

To be successful, students must have a working understanding of these courses:

• Administering Splunk SOAR (ASOAR)

Additionally, experience with Python programming is useful, but not required.

Zielgruppe

IT and security practitioners

Detaillierter Kursinhalt

Topic 1 – Introduction to Playbooks

• Understand automation best practices
• Design playbooks
• Python support
• Use the playbook manager

Topic 2 – Visual Playbook Editor

• Use the visual playbook editor
• Use actions and decisions
• Process action results
• Test new playbooks

Topic 3 – User Interaction and Logic

• Interact with users during playbook execution
• Format outputs
• Use decision blocks

Topic 4 – Accessing and Formatting Data

• Accessing action results
• Accessing artifact and container data
• Formatting data

Topic 5 – Modular Playbook Development

• Creating input playbooks
• Calling other playbooks
• Passing data between playbooks

Topic 6 – Custom Lists and Filters

• Custom list concepts
• Create custom lists
• Access lists from playbooks
• Use filters