v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB

Playbooks

Get Playbook For Detection

Retrieves playbooks that apply to the indicated detection.

get/connect/playbook/detection/{id}

Path parameters

idstring required

The public Id for the detection

Query parameters

rawboolean

If true, return the playbook in raw YAML format

Response

The playbook was successfully retrieved

contributorsstring[]

Authors of the playbook.

createTimestring

The date and time that this object was created. This is a read-only field.

createdstring

The date the playbook was created.

descriptionstring

The description of the playbook.

detection_categorystring

The category of detections this playbook applies to. May be empty.

detection_idstring

The specific Detection's public Id. May be empty if not specific to any 1 detection.

detection_type'nids' | 'sigma' | 'yara'

The type of detection this playbook applies to. This is analogous to which detection engine the playbook is for.

idstring

The ID assigned to this object by the server. This is a read-only field.

kindstring

The kind of object. This is a read-only field.

modifiedstring

The date the playbook was last modified.

namestring

The name of the playbook.

operationstring

The operation that was applied to the object. This is a read-only field.

updateTimestring

The date and time that this object was last modified. This is a read-only field.

userIdstring

The user ID (or API client ID) that initiated this event. This is a read-only field.

Example response

[
  {
    "contributors": [
      "['John Doe'",
      " 'Jane Smith']"
    ],
    "createTime": "2024-11-14T15:03:22Z",
    "created": "2023-10-01T12:00:00Z",
    "description": "This is a sample playbook",
    "detection_category": "process_creation",
    "detection_id": "ac5856cd-7e4c-4a61-8b15-6fc9148ff7f2",
    "id": "PdFc-JIBLkNJ8-bDfz47",
    "kind": "case",
    "modified": "2023-10-01T12:00:00Z",
    "name": "Sample Playbook",
    "operation": "create",
    "questions": [
      {
        "context": "Knowing if the attack comes from inside or outside the network can help determine if this is a false positive or a real attack.",
        "queryResults": [
          {
            "id": "ru5Jk5MB4OVrR03M8ee8",
            "payload": {
              "@timestamp": "2024-12-04T20:06:04.725Z",
              "@version": "1",
              "client.ip": "4.33.51.1",
              "client.port": "5544"
            },
            "sort": [
              "0:33.32.12.56"
            ],
            "source": "so:.ds-logs-zeek-so-2024.11.21-000017",
            "time": "2024-12-04T20:08:15.97Z",
            "timestamp": "2024-12-04T20:08:15.970Z"
          }
        ],
        "question": "What is the source IP address of the alert?",
        "range": "+/-3d"
      }
    ],
    "updateTime": "2024-11-14T15:33:02Z",
    "userId": "socl_my_new_client"
  }
]