<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE FL_Course SYSTEM "https://www.flane.de/dtd/fl_course095.dtd"><?xml-stylesheet type="text/xsl" href="https://portal.flane.ch/css/xml-course.xsl"?><course productid="26217" language="en" source="https://portal.flane.ch/swisscom/en/xml-course/splunk-dsoarp" lastchanged="2026-01-13T17:40:38+01:00" parent="https://portal.flane.ch/swisscom/en/xml-courses"><title>Developing SOAR Playbooks</title><productcode>DSOARP</productcode><vendorcode>SP</vendorcode><vendorname>Splunk</vendorname><fullproductcode>SP-DSOARP</fullproductcode><version>7.0</version><essentials>&lt;p&gt;To be successful, students must have a working understanding of these courses:
&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;span class=&quot;cms-link-marked&quot;&gt;&lt;a class=&quot;fl-href-prod&quot; href=&quot;/swisscom/en/course/splunk-asoar&quot;&gt;&lt;svg role=&quot;img&quot; aria-hidden=&quot;true&quot; focusable=&quot;false&quot; data-nosnippet class=&quot;cms-linkmark&quot;&gt;&lt;use xlink:href=&quot;/css/img/icnset-linkmarks.svg#linkmark&quot;&gt;&lt;/use&gt;&lt;/svg&gt;Administering Splunk SOAR &lt;span class=&quot;fl-prod-pcode&quot;&gt;(ASOAR)&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Additionally, experience with Python programming is useful, but not required.&lt;/p&gt;</essentials><audience>&lt;p&gt;SOAR automation engineers&lt;/p&gt;</audience><outline>&lt;p&gt;&lt;strong&gt;Module 1 &amp;ndash; Introduction to Playbooks&lt;/strong&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Understand automation best practices&lt;/li&gt;&lt;li&gt;Design playbooks&lt;/li&gt;&lt;li&gt;Python support&lt;/li&gt;&lt;li&gt;Use the playbook manager&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Module 2 &amp;ndash; Visual Playbook Editor&lt;/strong&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Use the visual playbook editor&lt;/li&gt;&lt;li&gt;Use actions and decisions&lt;/li&gt;&lt;li&gt;Process action results&lt;/li&gt;&lt;li&gt;Test new playbooks&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Module 3 &amp;ndash; User Interaction and Logic&lt;/strong&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Interact with users during playbook execution&lt;/li&gt;&lt;li&gt;Format outputs&lt;/li&gt;&lt;li&gt;Use decision blocks&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Module 4 &amp;ndash; Accessing and Formatting Data&lt;/strong&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Accessing action results&lt;/li&gt;&lt;li&gt;Accessing artifact and container data&lt;/li&gt;&lt;li&gt;Formatting data&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Module 5 &amp;ndash; Modular Playbook Development&lt;/strong&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Creating input playbooks&lt;/li&gt;&lt;li&gt;Calling other playbooks&lt;/li&gt;&lt;li&gt;Passing data between playbooks&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;strong&gt;Module 6 &amp;ndash; Custom Lists and Filters&lt;/strong&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Custom list concepts&lt;/li&gt;&lt;li&gt;Create custom lists&lt;/li&gt;&lt;li&gt;Access lists from playbooks&lt;/li&gt;&lt;li&gt;Use filters&lt;/li&gt;&lt;/ul&gt;</outline><essentials_plain>To be successful, students must have a working understanding of these courses:



- Administering Splunk SOAR (ASOAR)
Additionally, experience with Python programming is useful, but not required.</essentials_plain><audience_plain>SOAR automation engineers</audience_plain><outline_plain>Module 1 – Introduction to Playbooks


- Understand automation best practices
- Design playbooks
- Python support
- Use the playbook manager
Module 2 – Visual Playbook Editor


- Use the visual playbook editor
- Use actions and decisions
- Process action results
- Test new playbooks
Module 3 – User Interaction and Logic


- Interact with users during playbook execution
- Format outputs
- Use decision blocks
Module 4 – Accessing and Formatting Data


- Accessing action results
- Accessing artifact and container data
- Formatting data
Module 5 – Modular Playbook Development


- Creating input playbooks
- Calling other playbooks
- Passing data between playbooks
Module 6 – Custom Lists and Filters


- Custom list concepts
- Create custom lists
- Access lists from playbooks
- Use filters</outline_plain><duration unit="d" days="1">1 day</duration><pricelist><price country="US" currency="USD">1000.00</price><price country="GB" currency="GBP">835.00</price><price country="PL" currency="USD">1000.00</price><price country="DE" currency="EUR">1000.00</price><price country="AT" currency="EUR">1000.00</price><price country="SE" currency="EUR">1000.00</price><price country="CA" currency="CAD">1380.00</price><price country="CH" currency="CHF">1100.00</price></pricelist><miles><milesvalue country="CA" vendorcurrency="SPC" vendorcurrencyname="Splunk Training Units">100.00</milesvalue><milesvalue country="US" vendorcurrency="SPC" vendorcurrencyname="Splunk Training Units">100.00</milesvalue><milesvalue country="GB" vendorcurrency="SPC" vendorcurrencyname="Splunk Training Units">100.00</milesvalue><milesvalue country="SI" vendorcurrency="SPC" vendorcurrencyname="Splunk Training Units">100.00</milesvalue><milesvalue country="PL" vendorcurrency="SPC" vendorcurrencyname="Splunk Training Units">100.00</milesvalue><milesvalue country="DE" vendorcurrency="SPC" vendorcurrencyname="Splunk Training Units">100.00</milesvalue><milesvalue country="CH" vendorcurrency="SPC" vendorcurrencyname="Splunk Training Units">100.00</milesvalue><milesvalue country="AT" vendorcurrency="SPC" vendorcurrencyname="Splunk Training Units">100.00</milesvalue></miles></course>