Share Use Cases with Others
- Jonas Gonzalez
The Devo SOAR content exchange is a central repository of content created by Devo SOAR and by Devo SOAR customers. Through the exchange, you can publish content that you’ve created and access content created by other Devo SOAR customers. Devo SOAR also uses the exchange to publish content in advance of the next software release.
A published package of content is called a use case. Use cases are intended to address a particular need, such as consolidation of IDS alerts or detection of malicious command line entries.
Each use case consists of a playbook along with its associated resources, which can include event types, integrations, modules, or connections.
The content exchange is listed in the UI as part of the automation library. To access existing content in the content exchange, select Automations > Use Cases on the left navigation.
Search or browse for the use case of your choice. To view information about the use case, click Details. The details include a readme and a list of the resources in the package.
Add a Use Case
To share content through the exchange, create a use case as follows:
Go to My Library > Playbooks on the left navigation.
Find the playbook you want to share.
Click the More (...) icon and select Create Use Case.
Enter an ID for the user case, subject to these constraints:
The ID must be unique. If it isn’t, an error is generated when you try to save the use case.
The ID can include alphanumeric characters and underscore ( _ ).
The first character cannot be a number.
Enter a name for the use case.
Select one or more categories for the use case. Categories determine how the use case is listed in the automation library.
To add a new category, click New Tag, enter text, and press Return.
Enter a description for the use case. The description is shown below the version information in the automation library.
Enter any information to include in the Readme tab of the use case details.
Click Save.
Find, View, and Publish Use Cases
To view the use case that you created, select Automations > Use Cases on the side menu and search by the use case name (you can't search by ID). Then do any of the following:
To view the use case details, click Details. The details include the Readme and a list of the contents package on the Resources tab.
To modify the use case settings, click the More icon (...) and select Edit.
To copy the use case, click the More icon (...) and select Clone.
To remove the use case from the library, click the More icon (...) and click Delete.
To publish the use case for sharing with other Devo SOAR customers, click the More icon (...) and click Publish.
When you publish a use case, Devo SOAR reviews the contents to verify that the use case works, does what is intended, and is appropriate for sharing. If approved, the use case is listed in the content exchange as published and available for import.
Import a Use Case
If you find a use case in the content exchange that you want to make use of, you can import it to your environment.
Select Automations > Use Cases on the side menu and click Global Library at the top of the page. Search by the use case name (you cannot search by ID). Click Import.
As prompted, select the type of connection and the method to address any dependencies and conflicts. For information on resolving dependencies and conflicts, see Export and Import Playbooks.
The imported use case is added to the list of playbooks on the Playbooks page. The name of the new use case-based playbook is USECASENAME_PLAYBOOKNAME
Example:
Score_by_Top_Level_Domain_MyPlaybook