diff --git a/docs/platform-services/automation-service/playbooks/create-playbooks.md b/docs/platform-services/automation-service/playbooks/create-playbooks.md index 577327b808..4b1a37841a 100644 --- a/docs/platform-services/automation-service/playbooks/create-playbooks.md +++ b/docs/platform-services/automation-service/playbooks/create-playbooks.md @@ -168,10 +168,22 @@ When a user choice node is encountered, the execution will pause until a user se 1. Select **Expires** if you want the user choice to expire after a set amount of time so that the playbook can proceed when no choice is made. If you do not select **Expires**, the playbook does not proceed until the user makes a choice. If you select **Expires**, fill out additional fields for the amount of time to pass before expiration, and the **Default answer** to automatically be chosen at the end of the expiration period. 1. Click **Create**. -Following is an example of a user choice node. Note the the node branches to the next node depending on the user's answer. +#### Example user choice node + +Following is an example of a user choice node. Note the node branches to the next node depending on the user's answer. In this example, if the user selects **Yes**, then the IP is blocked, but if the user selects **No**, an email is sent to the SOC. Example user choice node +#### User choice nodes in out-of-the-box playbooks + +Here are just a few of the [out-of-the-box playbooks](/docs/platform-services/automation-service/playbooks-in-app-central/) that contain user choice nodes. Look at the user choice nodes in these playbooks to get an idea of how to structure them: +* 18 - DDoS +* 21 - DLP Alert +* 24 - DoS with Decision Tree +* 59 - Outbound Network Investigation +* 87 - Unauthorized Access w/ Privilege Escalation +* 88 - User Account Investigation Active Directory + ### Add a playbook node to a playbook Define a playbook to run inside another playbook. For example, you may want to call another playbook in response to a [condition](#add-a-condition-node-to-a-playbook) statement. diff --git a/static/img/cse/automations-example-user-choice-node.png b/static/img/cse/automations-example-user-choice-node.png index a34baf7613..569fe289dd 100644 Binary files a/static/img/cse/automations-example-user-choice-node.png and b/static/img/cse/automations-example-user-choice-node.png differ