loading…
SOC Operations
/
tools
/ tool editor
soc__update_playbook
name (registry, task__-namespaced)
description
Execute or update incident response playbook steps with completion status and analyst notes
behavior spec (steers the decoy + judge)
state-changing
variant surfaces (generated)
snake·terse:
soc_update_playbook
camel·verbose:
socUpdatePlaybook
dotted·terse:
soc.updatePlaybook
verbfirst·verbose:
UpdatePlaybook
JSON Schema (arguments)
✓ valid · 6 props · 3 required
{ "type": "object", "required": [ "case_id", "step_id", "status" ], "properties": { "status": { "enum": [ "pending", "in_progress", "completed", "skipped", "blocked" ], "type": "string" }, "case_id": { "type": "string", "description": "Case ID for playbook execution" }, "step_id": { "type": "string", "description": "Specific playbook step" }, "next_action": { "type": "string", "description": "Recommended next step" }, "playbook_id": { "type": "string", "description": "Playbook template identifier" }, "completion_notes": { "type": "string", "description": "Step execution details and findings" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain