Playbooks the community already built
Community playbooks, solution packs and connectors for your SOAR platform. Explore them visually, check what they need, import in minutes.
- Playbooks
- 9
- Solution packs
- 0
- Connectors & widgets
- 0
- Ready from Content Hub
- 100%
Look inside
Every playbook opens as a graph. Click one to explore it step by step.
Investigates suspicious mailbox forwarding rules: audit history, current rules and directory lookups.
Open playbookBrowse by use case
Start from the problem you're solving.
Alert triage
Classify, deduplicate and prioritise incoming alerts.
Threat intel enrichment
Look up IPs, domains, hashes and URLs against intel sources.
Phishing response
Analyse reported emails and clean up mailboxes.
Containment
Block indicators, isolate hosts, disable accounts.
Vulnerability management
Ingest scan results and drive remediation.
Identity & access
Account lifecycle, MFA resets, privilege reviews.
Case management
Incident creation, escalation, SLAs and hand-offs.
Data ingestion
Pull alerts, events and feeds into the platform.
Notification & ticketing
Email, chat and ticketing integrations.
Reporting
Metrics, summaries and scheduled reports.
Utilities
Reusable building blocks and helper playbooks.
Recently published
Fresh from contributors, checked and sanitized.
Threat feed ingestion template
Fetch-and-create skeleton for bulk-ingesting threat intel indicators.
Data ingestion template
Fetch / Create / Ingest skeleton for building a connector-based alert ingestion.
Ask an analyst before blocking
Pauses for analyst approval, then acts on the response.
Mailbox forwarding-rule triage
Investigates suspicious mailbox forwarding rules: audit history, current rules and directory lookups.
Set alert severity from AbuseIPDB score
Checks an alert's source IP against AbuseIPDB and raises severity when the abuse score is high.
IP reputation verdict with VirusTotal
Looks up an IP on VirusTotal and branches on the malicious-engine count.
How it works
- 01
Find
Search by use case, connector or trigger, and open any playbook as an interactive graph.
- 02
Check dependencies
Every item lists the connectors it needs and whether they are on the Content Hub.
- 03
Import
Download a sanitized, inactive export and bring it in with the Import Wizard.
Built something useful? Share it.
Submit a playbook, solution pack or connector. Automated checks strip owners and secrets, then it goes live once it passes review.