Playbook
A playbook is an automated workflow that runs steps against tools when a trigger fires: enrich, decide, notify, act. It differs from a runbook in that a machine runs it. A playbook is only as safe as its gates, its scope limits and its tests.
Definition
Most SOAR products build playbooks in a visual editor, with code behind it for custom steps. The trigger, the condition and the action are the three parts to read first.
Test a playbook against a copy of real alerts before it can touch a production host. A condition that is wrong by one field can isolate the wrong machines.
Playbook in Splunk SOAR's documentation
Splunk SOAR's documentation says playbooks are built in a Visual Playbook Editor that needs no code, and the Python Editor tab shows the Python that the visual playbook generates. vendor claim Source: help.splunk.com/en/splunk-soar/soar-cloud/bui... · Read
The example names a vendor and its own page. A vendor's use of Playbook may differ from the definition above; the rubric uses the definition on this page.