From 5f0d780f91b2358f24c28c8924170267c8b74943 Mon Sep 17 00:00:00 2001 From: Jake Lee Date: Thu, 16 Jan 2025 16:41:51 -0800 Subject: [PATCH 1/2] Update automation-service-playbooks.md add note to playbook payloads section --- .../automation-service/automation-service-playbooks.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/platform-services/automation-service/automation-service-playbooks.md b/docs/platform-services/automation-service/automation-service-playbooks.md index 94140c85bc..d8c65794f2 100644 --- a/docs/platform-services/automation-service/automation-service-playbooks.md +++ b/docs/platform-services/automation-service/automation-service-playbooks.md @@ -244,9 +244,13 @@ You select the initial object to use for the payload when you [create a playbook * **Insight**. An [Insight](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/) from an [automation in Cloud SIEM](/docs/cse/automation/automations-in-cloud-siem/). * **Entity**. An [entity](/docs/cse/records-signals-entities-insights/view-manage-entities/) from an [automation in Cloud SIEM](/docs/cse/automation/automations-in-cloud-siem/). * **Alert**. An [alert](/docs/alerts/) from an [automated playbook in a monitor](/docs/alerts/monitors/use-playbooks-with-monitors/). - * **Parse from json**. A payload from a [parent playbook](/docs/platform-services/automation-service/automation-service-playbooks/#add-a-playbook-node-to-a-playbook). (You can also select this option if you want to pass a custom payload from an alert.) + * **Parse from json**. A payload from a [parent playbook](/docs/platform-services/automation-service/automation-service-playbooks/#add-a-playbook-node-to-a-playbook). You can also select this option if you want to pass a custom payload from an alert. * Leave blank if the trigger will be a Cloud SOAR [incident or triage](/docs/cloud-soar/incidents-triage). +:::note +If you are using [nested playbook nodes](/docs/platform-services/automation-service/automation-service-playbooks/#add-a-playbook-node-to-a-playbook), then you will need to configure the parameters of the Start Node in the child playbook to include the outputs of the parent playbook that are passed to the child playbook. It is not recommended to use parameter arrays (i.e. signals[].id) as the Start Node parameters for the child playbook, as you should use a standard parameter names instead (i.e. signals.id). +::: + Following are examples of payloads from different trigger types: * [Alert payload](#alert-payload) * [Entity payload](#entity-payload) From 4981a8ddeb09c27f5b60c9d883f121268b58f230 Mon Sep 17 00:00:00 2001 From: "John Pipkin (Sumo Logic)" Date: Fri, 17 Jan 2025 10:24:03 -0600 Subject: [PATCH 2/2] Update docs/platform-services/automation-service/automation-service-playbooks.md Co-authored-by: Kim (Sumo Logic) <56411016+kimsauce@users.noreply.github.com> --- .../automation-service/automation-service-playbooks.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/platform-services/automation-service/automation-service-playbooks.md b/docs/platform-services/automation-service/automation-service-playbooks.md index d8c65794f2..b8d4fbcdc1 100644 --- a/docs/platform-services/automation-service/automation-service-playbooks.md +++ b/docs/platform-services/automation-service/automation-service-playbooks.md @@ -248,7 +248,7 @@ You select the initial object to use for the payload when you [create a playbook * Leave blank if the trigger will be a Cloud SOAR [incident or triage](/docs/cloud-soar/incidents-triage). :::note -If you are using [nested playbook nodes](/docs/platform-services/automation-service/automation-service-playbooks/#add-a-playbook-node-to-a-playbook), then you will need to configure the parameters of the Start Node in the child playbook to include the outputs of the parent playbook that are passed to the child playbook. It is not recommended to use parameter arrays (i.e. signals[].id) as the Start Node parameters for the child playbook, as you should use a standard parameter names instead (i.e. signals.id). +If you are using [nested playbook nodes](/docs/platform-services/automation-service/automation-service-playbooks/#add-a-playbook-node-to-a-playbook), then you will need to configure the parameters of the Start Node in the child playbook to include the outputs of the parent playbook that are passed to the child playbook. It is not recommended to use parameter arrays (for example, `signals[].id`) as the Start Node parameters for the child playbook; you should use a standard parameter names instead (for example, `signals.id`). ::: Following are examples of payloads from different trigger types: