---
title: "Get Event-Specific Playbook"
method: GET
path: "/connect/playbook/event/{id}"
tags: ["Playbooks"]
---

# Get Event-Specific Playbook

`GET /connect/playbook/event/{id}`

Fetches the playbook for a specific event.

## Path parameters

- `id` string, required

## Response `200`

The playbook was successfully retrieved

- ModelPlaybook[]
  - `contributors` string[] — Authors of the playbook.
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `created` string — The date the playbook was created.
  - `description` string — The description of the playbook.
  - `detection_category` string — The category of detections this playbook applies to. May be empty.
  - `detection_id` string — The specific Detection's public Id. May be empty if not specific to any 1 detection.
  - `detection_type` 'nids' | 'sigma' | 'yara' — The type of detection this playbook applies to. This is analogous to which detection engine the playbook is for.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `kind` string — The kind of object. This is a read-only field.
  - `modified` string — The date the playbook was last modified.
  - `name` string — The name of the playbook.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `questions` ModelQuestion[] — The questions of this playbook that guide the user in response to an alert.
    - `answer_sources` string[] — Where the answer to this question can be found.
    - `context` string — Some context to be provided to the user. This describes why the answer might be useful.
    - `fields` string[] — not returned by the API, only used internally
    - `filledQuery` string — The query after variable substitution has been performed.
    - `oqlQuery` string — The event-specific query in OQL format
    - `query` string — A raw YAML Sigma query that can be used to find the answer to this question. May contain variables that will be replaced with values from the alert.
    - `queryResults` ModelEventRecord[] — The results after the queries have been substituted, converted, and executed.
      - `id` string — The event's unique document ID
      - `payload` object — The event data fields
      - `score` number — The score of the event, often left 0
      - `sort` unknown[] — The values used for the purposes of sorting across the returned event list
        - unknown
      - `source` string — The source index of the event
      - `time` string — The parsed event time
      - `timestamp` string — The event timestamp
      - `type` string — The type of event, often left blank
    - `question` string — The human readable question to be asked.
    - `range` string — An indicator for what time range the query should be limited to in order to find the answer.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.

## Other responses

- `400` — Malformed request
- `401` — Request was not properly authenticated
- `404` — Event not found
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/versions/0576ce393f8d/schema)