Playbook parameters

Kaspersky Next XDR Expert Help
What's new
About Kaspersky Next XDR Expert
- Hardware and software requirements
- Compatible applications and solutions
Architecture of Kaspersky Next XDR Expert
OSMP Console interface
- Pinning and unpinning sections of the main menu
- Changing the language of the OSMP Console interface
Licensing
- About the End User License Agreement
- About the license key
- About the activation code
- About the key file
- License limits
- Activating Kaspersky Next XDR Expert
- Viewing information about license keys in use
- Renewing licenses for Kaspersky applications
About data provision
- Data provision in Open Single Management Platform
- Data provision in Kaspersky Unified Monitoring and Analysis Platform
Quick start guide
- Deployment and initial setup of Kaspersky Next XDR Expert
- Verifying correctness of the Kaspersky Next XDR Expert configuration
- Using the threat monitoring, detection and hunting features
- Example of incident investigation with Kaspersky Next XDR Expert
Deployment of Kaspersky Next XDR Expert
- Hardening Guide
- Deployment scheme: Distributed deployment
- Deployment scheme: Single node deployment
- Ports used by Kaspersky Next XDR Expert
- Preparation work and deployment
- Kaspersky Next XDR Expert maintenance
Migration to Kaspersky Next XDR Expert
- About migration from Kaspersky Security Center Windows
Integration with other solutions
- Integration with Kaspersky Automated Security Awareness Platform
  - Creating a token in KASAP and getting a URL for API requests
- Integration with Kaspersky Threat Intelligence Portal
- Integration with KATA/KEDR
- Configuring custom integrations
Threat detection
- Working with alerts
- Working with incidents
Threat hunting
- Working with events
- Retrospective scan
- Getting events table statistics
Threat response
- Response actions
- Playbooks
REST API
- Creating a token
- Authorizing API requests
- API operations
Managing Kaspersky Unified Monitoring and Analysis Platform
- About Kaspersky Unified Monitoring and Analysis Platform
- What's new
- Program architecture
- Administrator's guide
- User guide
  - KUMA resources
  - Analytics
Working with Open Single Management Platform
- Basic concepts
- Configuring Administration Server
- Discovering networked devices
- Managing client devices
- Deploying Kaspersky applications
- Configuring Kaspersky applications
- Managing users and user roles
- Updating Kaspersky databases and applications
- Remote diagnostics of client devices
- Managing applications and executable files on client devices
- About the license
- API Reference Guide
Monitoring, reporting, and audit
- Scenario: Monitoring and reporting
- About types of monitoring and reporting
- Triggering of rules in Smart Training mode
  - Viewing the list of detections performed using Adaptive Anomaly Control rules
  - Adding exclusions from the Adaptive Anomaly Control rules
- Dashboard and widgets
- Reports
- Events and event selections
- Notifications and device statuses
- Kaspersky announcements
- Exporting events to SIEM systems
- Managing object revisions
- Rolling back an object to a previous revision
- Deletion of objects
- Downloading and deleting files from Quarantine and Backup
  - Downloading files from Quarantine and Backup
  - About removing objects from the Quarantine, Backup, or Active threats repositories
- Operation diagnostics of the Kaspersky Next XDR Expert components
Multitenancy
- About binding tenants to Administration Servers
- Configuring integration with Open Single Management Platform
- Viewing and editing tenants
- Adding new tenants
- Assigning roles to users in a tenant
- Deleting tenants
- Configuring a connection to SMTP
- Configuring notifications templates
Contact Technical Support
- How to get technical support
- Technical support via Kaspersky CompanyAccount
Known issues
Appendices
- Commands for components manual starting and installing
- Integrity check of KUMA files
- Normalized event data model
- Configuring the data model of a normalized event from KATA EDR
- Asset data model
- User account data model
- KUMA audit events
- Correlation rules
- Time format
- Mapping fields of predefined normalizers
Glossary
- Administrator host
- Agent
- Alert
- Asset
- Bootstrap
- Collector
- Configuration file
- Context
- Correlation rule
- Correlator
- Custom actions
- Distribution package
- Event
- Incident
- Investigation graph
- Kaspersky Deployment Toolkit
- Kubernetes cluster
- KUMA inventory file
- KUMA services
- Multitenancy
- Node
- Normalized event
- Observables
- Playbook
- Playbook algorithm
- Registry
- Response actions
- Segmentation rules
- Storage
- Target hosts
- Tenant
- Threat development chain
- Transport archive
Information about third-party code
Trademark notices

Threat response > Playbooks > Playbook algorithm > Playbook parameters

Playbook parameters

Parameter ID	Description
`name`	Playbook name. Specified by the system when creating or updating a playbook. If the value is set in the algorithm, it will be replaced by the system.
`description`	Playbook description. Specified by the system when creating or updating a playbook. If the value is set in the algorithm, it will be replaced by the system.
`version`	Playbook version. The minimum length is 1. This parameter is required.
`dslSpecVersion`	DSL schema version. The minimum length is 1. This parameter is required.
`responseActionsSpecVersion`	Response actions schema version. The minimum length is 1. This parameter is required.
`playbookRunTimeout`	The maximum execution time of the playbook, including waiting in the queue. The maximum value is 48 hours (`48h`). You can configure the maximum execution time in hours (h) and/or minutes (m). By default, the value is `24h`.
`inputType`	Inbound object type. The possible values: `alert` or `incident`. The inbound object type is specified by the system when creating or updating a playbook. If the value is set in the algorithm, it will be replaced by the system.
`input`	A jq expression that could be used to transform or filter incoming data before executing a playbook.
`output`	A jq expression that could be used to modify the output of the playbook before execution.
`timeouts`	Timeout definitions.
`executionFlow`	Steps of the playbook execution. This parameter is required.

Article ID: 270358, Last review: Dec 9, 2024

Page top