Developing SOAR Playbooks Course Overview:

This introductory course is designed to prepare IT and security practitioners to:

• Plan, design, create, and debug basic playbooks for Security Orchestration, Automation, and Response (SOAR).
• Gain an understanding of the fundamental capabilities of SOAR playbooks.
• Learn how to create and test SOAR playbooks effectively.

Completion of this course is a prerequisite for the Advanced SOAR Implementation course, providing a foundational understanding of SOAR playbooks and their usage.

Intended Audience:

• IT and Security Practitioners: Individuals responsible for IT operations and security management who want to learn about Security Orchestration, Automation, and Response (SOAR) playbook development.
• Security Analysts: Professionals involved in incident response and security operations looking to enhance their skills in creating and debugging SOAR playbooks.
• Splunk SOAR Administrators: Those responsible for administering Splunk SOAR and its associated playbooks.
• Professionals with Equivalent Knowledge: Individuals who possess equivalent working knowledge, as specified in the course prerequisites.

Learning Objectives of Developing SOAR Playbooks:

• Automation Best Practices
• The Visual Playbook Editor
• Creating Automation and Input Playbooks
• Using Actions and Decisions
• Using Action Results
• Testing and Debugging Playbooks
• User Interaction
• Output Formatting
• Complex Logic
• Interacting with Artifacts
• Using Files in a Playbook
• Custom Lists
• Data Filtering