Converting rules to playbooks

You cannot automatically migrate rules and workflows to a playbook in the Playbook designer. However, you can build a playbook based on the goal and data flow of one or more rules.

In previous releases, playbooks were based on rules.

In the Rules tab, click a rule name to see its properties. Transcribe the rule's properties into a playbook as follows.
  • The rule's object type becomes the playbook object type.
  • The rule's conditions become the playbook's conditions.
  • In the Ordered activities, any task that is listed in an Add task condition becomes a task node in the playbook. For multiple tasks, make sure that the order of the tasks is the same as listed in the rule. The rule's tasks are dynamically added while the playbook tasks are not.
  • In the Ordered activities, any script that is listed in a Run script task becomes a script node in the playbook. When multiple scripts are present, make sure that the order of the scripts matches the order that is listed in the rule.
  • The rule's Set field ordered activity has no direct correlation in the playbook. Instead, you can set the value of a field by using a script, function or by a user from a task. Also, for manually activated playbooks, you can have the user enter a value by configuring the activation form in the playbook.
  • A workflow that is started by a rule has no direct correlation in the playbook. You can add the same tasks, scripts, and functions into the playbook; however, you might need to write extra scripts to mimic the gateways. Be sure to approximate the paths in the workflow with the paths in your playbook.
  • When started by a workflow, a function has inputs, pre-process script, post-process script, and output. In the Playbook designer, the inputs and pre-process script are function inputs that are called Fields and Scripts in the function's details panel. The details panel also has an output name field. Replace the post-process script with a script that uses the playbook keywords.
  • Any message destination started directly from the rule or workflow has no direct correlation in the playbook.

If you base a playbook on an app, refer to the app's user guide for a description of the various components. The components might include functions and their pre-process and post-process scripts, example scripts, example rules, and any fields, data tables, and layouts. You can also view all the app's customizations by viewing the Apps tab, clicking the app's details, then selecting its Customizations tab, as described in Managing SOAR apps. You can also view all functions that were installed by an app in the playbook library.