Create Playbook Tags
A playbook tag is an identifier that can be used to define role-based access control (RBAC) for playbooks. To define RBAC for playbooks, analysts must create playbook tags and assign them to playbooks and user groups in Respond. The members of a user group in Respond can execute the playbooks whose tags match the tags assigned to the user group. For more information on assigning tags to a playbook, see Create Playbook.
For example, if you are a SOC (Security Operations Center) manager, then you can define RBAC for playbooks using tags and you can limit permission such as executing a playbook for junior security analysts.
Before you start
Ensure that the following prerequisites are met:
You have permission to View Tags and Create/Update Tags.
Respond is integrated with an Orchestrate instance.
In Respond, role-based access control of Playbooks is enabled under Admin Panel > Configurations > Integration > Orchestrate.
Steps
To create a playbook tag, follow these steps:
Go to Admin Panel > Playbook Tags.
Click New Tag.
Enter a name and description for the tag.
Select a Color for the tag and click Save.
Manage Playbook Tags
You can perform the following activities to manage playbook tags:
Edit tags to update tag name, tag description, and tag color. Hover over the tag and click the More icon. Select Edit and update the details as required.
Search for a tag.
Filter tags based on recent updates such as last week, last month, and more. Click Save Filter to save a filter and reuse it anytime.
Delete a tag that is not linked to any playbook. Hover over the tag and click the More icon and select Delete.
View linked playbooks count and details of a tag from the playbook tags listing page.
Sort tags based on the tag name and creation time.
Customize the table by clicking the Customize Table icon. Select the fields you want to display on the listing page and click Save.