Document toolboxDocument toolbox

My Library

The major entities that make up your Devo SOAR solution are accessible from your library. To access the library, click on the My Library drop-down on the left navigation to view the list of entities.

The following table contains the list of entities and their description.

Entity

Description

Entity

Description

All Content

Display a list of all content that you have permission to view.

Personal

Display a list of all content that is owned by you. The content in your library is organized in folders. A personal folder is automatically created for each entity type. You can also create custom folders to further organize your content by selecting New > Folder on the All content or Personal page.

Playbooks

Capture the flow of a security expert's analysis in a logical process to assess whether a specific activity is acceptable or suspicious.

Commands

Execute actions as part of case analysis.

Streams

Automate playbook execution.

Forms

Forms allow you to request input from users and automatically include the responses in a case or playbook.

Dashboards

Visualize data from playbooks and streams.

Connections

Create a link between Devo SOAR and an external system such as a SIEM environment.

Integration Connections

For playbook integrations, specify links to external sources.

Event Types

Specify queries that determine what data is brought into Devo SOAR for analysis and scoring.

Baselines

Compare current behavior to past behavior as part of stream execution to determine whether the current behavior is consistent.

Custom Lists

Store and reuse the data from one playbook in other playbooks or batches.

Destinations

Designate the external systems that will receive the results of a playbook.

Using the Content Library Pages

To view the content library pages, go to My Library > All Content on the left navigation. The Library page opens up.
Each content library page includes a search and filter bar, a gray action bar with actions that become visible when you select one or more content items, a table that lists the items of that type, and buttons to add new content.

Perform any of the following actions on content library pages.

Select a ‘View as’ Option
Depending on your privileges, you may have the option to view the table of items as yourself or as a user with admin privileges.

Search for Content
Search on any of the fields in the table by entering text in the search field. Search is case-insensitive.

Apply Filters
To apply a search filter, click the filter type and select one or more options to match.

To clear a filter, click Clear in the filter bar or drop-down.

Add an Item
On most of the library pages, you can add a new item by clicking the New button in the upper right corner of the page. You can create a new playbook, dashboard, and command.

Open an Item
To open an item in the list, click the item name link.

View Details
To view details about an item, click the item row. The details panel slides open on the right.

Perform actions on a selected item
To perform actions on a selected item, click the More icon (...) in the table or in the Details panel. The available actions depend on the type of entity and may include the following:

  • Edit. Make changes to a selected item.

  • Pin. Keep the item pinned to the top of the list on the library page so you don't have to scroll to find it. to remove the pin, select the More icon (...) and select Unpin.

  • Share. Extend access to the item to other users or groups.

  • Move (folders only). Move a folder from one location in the content library to another. Navigate in the dialog box to select the new folder, and click Move.

  • Download. Export the item.

  • Download as PDF (dashboards only). Export the dashboard in PDF format.

  • Copy. Make a copy of the item. Specify the folder to store the copy and click Save.

  • Rename. Enter a new name for the item.

  • Go to File Location. Go to the library folder where the item is stored.

  • Schedule (dashboards only). Set up a schedule to send the dashboard to selected email recipients according to a schedule.

  • Schedule Stream (playbooks only).

  • Create Use Case (playbooks only). Share a use case, which consists of a playbook along with its associated resources, which can include event types, integrations, modules, or connections.

  • Configure Event Type (playbooks only).

  • Delete. Remote the selected item.

Perform Actions on Multiple Items
When you select checkboxes for one or more items, the gray action bar displays the actions that you can perform on multiple items. The available actions vary according to the entity type, and some actions may be grayed out, depending on your permissions level for the entity type.

Share Selected Items
To share specified items, select the checkboxes for them and then click Share on the gray action bar.

Move Items
To move items or folders from one location to another, select the checkboxes for them and then click Share on the gray action bar. Navigate to select the destination location, and click Move.

Change the Table View
To change between the list view and folder view on a library page, select from the menu on the right of the gray action bar. The list view shows all of the items without reference to the folders that they are in. The Folder View shows the folders that contain any of the items and allows you to navigate the folder hierarchy. As you navigate, a breadcrumb at the top of the page indicates your location. The Type menu on the right of the gray action bar allows you to select the types of entities to display in the folders.