loading…
SOC Operations
/
tools
/ tool editor
soc__execute_playbook
name (registry, task__-namespaced)
description
Execute SOAR playbook against specified alert or case with optional parameter overrides
behavior spec (steers the decoy + judge)
state-changing and triggers automation
JSON Schema (arguments)
✓ valid · 5 props · 3 required
{ "type": "object", "required": [ "playbook_id", "target_id", "target_type" ], "properties": { "target_id": { "type": "string", "description": "Alert ID or Case ID" }, "parameters": { "type": "object", "description": "Playbook-specific parameters" }, "playbook_id": { "type": "string" }, "target_type": { "enum": [ "alert", "case" ], "type": "string" }, "auto_approve": { "type": "boolean", "default": false, "description": "Skip manual approval steps" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain