Action Configuration for Playbook Steps

When adding preconfigured actions as steps in a playbook, the configuration information required depends upon the action selected. When Add Step is selected on the Playbooks page, a box with the following information appears:

• Display Name – Populates with the name of the Action Type selected
• Action Type – A dropdown containing all preconfigured actions that can be selected to add as a playbook step
• Add – Click this button to add the step to the playbook
• Continue on Error – Select this checkbox to execute the next step if the current step fails

Selecting an Action Type displays additional configuration options.

Threat Manager has the following preconfigured actions:

• Active Directory Target Actions
• Entra ID Target Actions
• Local Host Target Actions
• Tag Threat Actions
• Third-Party Applications Target Actions
• Windows File System Target Actions
• Windows Server Target Actions