Playbook Library
Security automation playbooks, ready to deploy
Browse 17+ pre-built playbooks connecting your SIEM, EDR, threat intel, and ticketing tools. Every playbook is a real, shippable workflow, not a stub.
17 playbooks
Splunk Incident to ServiceNow Ticket + Slack Alert
Automatically open a ServiceNow ticket and notify your security channel whenever a Splunk incident fires.
Outlook Phishing Detection with VirusTotal
Scan every inbound Outlook email for malicious URLs and attachments, delete threats, and notify Slack.
Gmail Phishing Detection with VirusTotal
Scan incoming Gmail messages for malicious links and attachments, delete threats, and alert security.
CrowdStrike Host Isolation with ServiceNow & Slack
Isolate or restore a compromised host in CrowdStrike, notify the device owner, and track it in ServiceNow.
CrowdStrike + Okta EDR Compliance Validation
Daily check that every Okta-enrolled employee has a CrowdStrike agent running on their device.
CrowdStrike + Google Workspace EDR Compliance
Validate CrowdStrike Falcon is installed on every Google Workspace user's device, reported daily.
CrowdStrike + Jamf Mac Fleet EDR Validation
Verify every Jamf-enrolled Mac has a working CrowdStrike Falcon sensor, daily.
CrowdStrike IOC Hunt Across Fleet
Search your entire CrowdStrike fleet for a specific Indicator of Compromise and report matches to Slack.
CrowdStrike Stale Sensor Cleanup
Find and remove CrowdStrike Falcon sensors inactive for over 12 hours, with Slack approval.
SentinelOne + Okta EDR Compliance Validation
Daily check that every Okta user has a SentinelOne agent running on their device.
SentinelOne + Google Workspace Compliance
Ensure every Google Workspace user has a SentinelOne agent deployed, checked daily.
Universal IOC Lookup in VirusTotal
Check any hash, URL, domain, or IP against VirusTotal and return a clean verdict for analysts.
Suspicious File Detonation in Hybrid Analysis
Submit a suspicious file to Hybrid Analysis for sandbox detonation and return the scan job ID.
Wiz Cloud Vulnerability Triage
When Wiz detects a high-severity cloud vulnerability, notify Slack and prompt for a ServiceNow ticket.
Datadog Incident to Jira Ticket
Automatically create a Jira ticket and notify Slack whenever Datadog Incident Management fires.
Multi-Source Phishing Email Analysis
Analyze phishing emails with EmailRep, URLScan, and VirusTotal to produce a comprehensive threat report.
Suspicious Email Triage with EDR Correlation
Multi-tool email triage that cross-references threat intel with CrowdStrike endpoint detections.
Don't see the playbook you need?
Deployer Workflows lets you build any playbook visually without code. Connect any SIEM, EDR, or threat intel source in minutes.