Playbooks

Get Playbook For Detection

Retrieves playbooks that apply to the indicated detection.

get/connect/playbook/detection/{id}

Path parameters

idstring required

The public Id for the detection

Query parameters

rawboolean

If true, return the playbook in raw YAML format

Response

The playbook was successfully retrieved

contributorsstring[]

Authors of the playbook.

createTimestring

The date and time that this object was created. This is a read-only field.

createdstring

The date the playbook was created.

descriptionstring

The description of the playbook.

detection_categorystring

The category of detections this playbook applies to. May be empty.

detection_idstring

The specific Detection's public Id. May be empty if not specific to any 1 detection.

detection_type'nids' | 'sigma' | 'yara'

The type of detection this playbook applies to. This is analogous to which detection engine the playbook is for.

idstring

The ID assigned to this object by the server. This is a read-only field.

kindstring

The kind of object. This is a read-only field.

modifiedstring

The date the playbook was last modified.

namestring

The name of the playbook.

operationstring

The operation that was applied to the object. This is a read-only field.

updateTimestring

The date and time that this object was last modified. This is a read-only field.

userIdstring

The user ID (or API client ID) that initiated this event. This is a read-only field.

Example response

[
  {
    "contributors": [
      "['John Doe'",
      " 'Jane Smith']"
    ],
    "createTime": "2024-11-14T15:03:22Z",
    "created": "2023-10-01T12:00:00Z",
    "description": "This is a sample playbook",
    "detection_category": "process_creation",
    "detection_id": "ac5856cd-7e4c-4a61-8b15-6fc9148ff7f2",
    "id": "PdFc-JIBLkNJ8-bDfz47",
    "kind": "case",
    "modified": "2023-10-01T12:00:00Z",
    "name": "Sample Playbook",
    "operation": "create",
    "questions": [
      {
        "context": "Knowing if the attack comes from inside or outside the network can help determine if this is a false positive or a real attack.",
        "queryResults": [
          {
            "id": "ru5Jk5MB4OVrR03M8ee8",
            "payload": {
              "@timestamp": "2024-12-04T20:06:04.725Z",
              "@version": "1",
              "client.ip": "4.33.51.1",
              "client.port": "5544"
            },
            "sort": [
              "0:33.32.12.56"
            ],
            "source": "so:.ds-logs-zeek-so-2024.11.21-000017",
            "time": "2024-12-04T20:08:15.97Z",
            "timestamp": "2024-12-04T20:08:15.970Z"
          }
        ],
        "question": "What is the source IP address of the alert?",
        "range": "+/-3d"
      }
    ],
    "updateTime": "2024-11-14T15:33:02Z",
    "userId": "socl_my_new_client"
  }
]

Changes

Changed in 5 of the 23 revisions of this API.116

Dec 15, 2025512723525b002See the full diff
- ○
  added the optional property items/questions/items/fields to the response with the 200 status
  response-optional-property-added
- ○
  added the optional property items/questions/items/oqlQuery to the response with the 200 status
  response-optional-property-added
This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Oct 23, 2025dd1538426ed42See the full diff
- ○
  added the optional property items/questions/items/filledQuery to the response with the 200 status
  response-optional-property-added
- ○
  added the optional property items/questions/items/queryResults to the response with the 200 status
  response-optional-property-added
Aug 6, 2025e4fd33b5be2b11See the full diff
- ●
  removed the optional property items/date from the response with the 200 status
  response-optional-property-removed
- ○
  added the optional property items/created to the response with the 200 status
  response-optional-property-added
Jun 25, 202554f85cd6b59d1See the full diff
- ○
  endpoint added
  endpoint-added
Dec 10, 2024ee1120fd1e201See the full diff
- ▲
  api path removed without deprecation
  api-path-removed-without-deprecation
This revision also has 35 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history