A new analyst asks what a SOAR playbook is in the city's defense stack. What is the accurate description?
Select an answer to reveal the explanation.
Short Explanation
A playbook is the kitchen recipe that SOAR cooks automatically—ticket, enrich, block—not the ES dashboard on the wall. Dashboards show; playbooks do. Mixing those up sends analysts shopping in the wrong aisle.
Full Explanation
A SOAR playbook is an automated workflow that runs in Splunk SOAR and can enrich, ticket, block, or disable accounts as coded steps; it is not an Enterprise Security dashboard, an accelerated CIM data model, or a notable disposition. New analysts in the city's defense stack need that distinction so they know what they are triggering from ES versus what they are merely viewing, searching, or labeling during an investigation. Civic SOCs mix ES visibility with SOAR action—confusing the two sends the wrong ticket or the wrong expectation to leadership.
A built-in Enterprise Security dashboard that graphs notables visualizes Incident Review and related panels; it does not execute SOAR workflow steps such as ticketing or account disable. An accelerated CIM data model used by tstats is a search-acceleration and normalization construct for CIM data, not a playbook that takes response actions. A notable disposition such as True Positive is an analyst judgment label on an ES notable and does not by itself run automation that tickets or blocks.
Exam caveat: SPLK-5001 requires knowing playbooks live in SOAR as automated workflows distinct from ES dashboards, CIM models, and dispositions, even when ES is the place the analyst clicks to start them. Operational check: from a sample civic notable, identify the Send to SOAR or Run Playbook action path, open the referenced enrichment or containment playbook name in SOAR (read-only if needed), and contrast that multi-step workflow with the ES dashboard and disposition controls on the same notable.