Export and Import Playbooks

You can export a playbook to a JSON file and import a playbook JSON file that was previously exported. For information on exporting playbooks that include associated custom lists data, see Export and Import Custom Lists.

Export a Playbook

Exporting a playbook definition to a JSON file allows you to modify or share it.

• You can export a playbook definition to adapt it for new analysis and then import it back to the Devo SOAR system as a new playbook.

• You can share an exported playbook definition with a colleague who then can import and use it as their own playbook.

To export, click the arrow to the right of the playbook on the Playbooks page and select Download. Follow the instructions for your browser to save the playbook in JSON file format.

Devo SOAR allows you to download data from files and custom lists with Playbook. You will be able to export files from:

• File connection type

• Get data from CSV

• Custom lists with data

Select the required file or list to download the data and click Download.

Publish a Playbook

To publish a playbook, you need to create a use case and publish it.

Select the required file or list to publish the data and click Publish.

Import a Playbook and Resolve Conflicts

Devo SOAR allows you to import a playbook that was previously exported.

The JSON file that defines a playbook Devo SOAR contains references to one or more of the following entities:

• Event type

• Connections

• Integration connections

• Modules

• Integrations

When you import a playbook, a conflict occurs if any of the following apply:

• An event type in the imported playbook has the same name as an existing event type.

• A connection in the imported playbook has the same name as an existing connection.

• An integration connection in the imported playbook has the same name as an existing integration connection.

• A module in the imported playbook has the same ID as an existing module.

• An integration has the same ID as an existing integration.

When Devo SOAR detects a conflict during import, you are given a choice of how you want to resolve the conflict.

To import a previously exported playbook, drag and drop the JSON file onto the Playbooks page. If a playbook exists with the same name, you're prompted to replace the current playbook or change the name of the new one.

A page opens to show the status of the event types, connections, integration connections, modules, and integrations in the playbook. You can search and filter to find the elements you're looking for.

If there is no conflict, the element is shown with a checkmark.

If there is no conflict but something additional is required before the playbook can run, a warning is displayed. For example, a warning occurs if a connection requires credentials because Devo SOAR doesn’t include passwords in the exported JSON file.

If a conflict in a playbook element is found, click Resolve and select one of the following options:

• Reuse the existing element (reject the imported element).

• Replace the existing element with the new one.

• Keep both elements by renaming the one that's being imported. (For modules and integrations, you must change the ID. Changing the name is optional.)

To resolve conflicts for multiple elements at once, select the checkboxes for the elements and click Resolve All.

When all conflicts are resolved, click Next and then Import.

The playbook is imported and you are prompted to set up event types now or wait until later. To add event types, click Configure Event Types. Select the connection and click Next. Specify a query and click Submit. The query is automatically generated and the event type is configured with the query.