Developing SOAR Playbooks

Course Duration

1 Day

Audience

Employees of federal, state and local governments; and businesses working with the government.

Prerequisites

Basic familiarity with Splunk SOAR and security operations concepts. Python programming knowledge is helpful for custom action development.

Course Description

This 9-hour introductory course prepares IT and security practitioners to plan, design, create, and debug basic Splunk SOAR playbooks. Students learn playbook design principles, use the visual playbook editor to build automation workflows, work with SOAR actions and connectors, and implement playbook best practices for security operations automation.

Learning Objectives

• Understand automation best practices and playbook design principles
• Use the Splunk SOAR visual playbook editor to build workflows
• Configure SOAR actions and work with app connectors
• Implement decision logic and parallel execution in playbooks
• Debug and troubleshoot playbook execution issues
• Apply playbook best practices for SOC automation

Course Outline

Introduction to Playbooks

• Automation best practices
• Designing playbooks
• Python support in SOAR
• Using the playbook manager

Visual Playbook Editor

• Editor interface and workflow
• Adding and connecting actions
• Decision logic and branching
• Parallel execution

Working with Actions

• SOAR app connectors
• Action inputs and outputs
• Testing and debugging actions
• Playbook testing and validation

Frequently Asked Questions