Running a playbook
Use the navigation menu to open a playbook and create a new investigation, or add it to an existing investigation.
To quickly run a playbook:
- From the top navigation, select Investigations > Playbook.
-
To select a playbook click the playbook name or click Select.
- Configure the playbook settings:
Date range Use the date picker to configure the date range. Enable Facets Select to return the panel that allows narrowing the search. This may make the query longer to complete. For more information, see Facet Search. Variables Enter the required variable(s) for the queries. Multiple variables are supported.
Values can be entered either as:
Individual items, followed by the tab or enter key. The value appears as a pill that can then be deleted, if required.
Bulk indicator icon. This brings up an entry screen. Pasting the text is supported. After pressing the button, FortiNDR Cloud extracts the applicable indicators from the text and adds them as variables. You can also delete the unneeded variables.
Create a New Investigation Select this option to create a new investigation. Enter the Investigation Name and Description.
The default name for new investigations is the first and last name of the user creating the investigation as well as a date stamp of when the investigation was created.
Add to Existing Investigation
From the Choose Investigation dropdown, select and investigation.
-
Click Run Playbook.