Community driven repository of Playbooks and Apps for ThreatConnect.
Branch: master
Clone or download
paulh-tc Merge pull request #113 from fhightower/jan29-updates
Adding pyparsing grammar search TCPB app & example
Latest commit 20cc33a Jan 31, 2019

Copyright (c) 2018 ThreatConnect, Inc.

ThreatConnect Playbooks

Build Status

This repository gives ThreatConnect customers the ability to create and share Playbooks, Playbook Components, and Playbook Apps for use with their instance of ThreatConnect. Our hope for this repo is that it will:

  • Help promote usage of ThreatConnect via a community of developers,
  • Help customers identify new use cases, and
  • Give new customers the opportunity to learn from existing customers.

This Repository is public. However, contributions will be accepted only from identified ThreatConnect customers. The ThreatConnect Support Team will validate each contribution request before they are published within the Repository, as well as enforce certain formatting requirements.

Please Note: the Support Team will not validate code for functionality or security.


For more information on contributing to this repository, see our Contributions Guide.


Documentation for the ThreatConnectⓇ App Framework is available here: The framework provides commonly used Classes and Methods for writing ThreatConnect Apps. The Framework is intended to speed up the development process and ensure Apps contains the core functionality required.

Documentation specific to Playbooks can be found here:

Best practices for creating effective and maintainable Playbooks can be found here:

To create a job or playbook app using tcex, you can use the tcinit command provided in the tcex package (documentation on this function is coming soon).

Other Repositories

We currently provide our customers with four repositories to share your projects with the rest of the ThreatConnect Community.


If you have any questions, bugs, or requests please contact


Access to this Repository is governed by the Apache 2.0 License.

Terms of Service

Access to this Repository is governed by the following Terms of Service.