A new analyst asks what a SOAR playbook is in the city's defense stack. What is the accurate description?
Select an answer to reveal the explanation.
Short Explanation
A playbook is the kitchen recipe that SOAR cooks automatically—ticket, enrich, block—not the ES dashboard on the wall. Dashboards show; playbooks do. Mixing those up sends analysts shopping in the wrong aisle.
Full Explanation
A SOAR playbook is an automated workflow that runs in Splunk SOAR, distinct from Enterprise Security searches, dashboards, CIM data models, and notable dispositions. Analysts need that distinction so they know what they are triggering from ES. Graphing notables or accelerating models is not playbook execution.