---
title: "Playbook Configuration"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDwDDIforSplunkSOAR/1688371405/Playbook%20Configuration"
format: markdown
---
The following configuration steps apply to all playbooks, with additional notes for specific ones.

### Importing and Selecting the Asset

After importing the .tgz playbook:

1. Open the **Playbook Editor**.
2. Locate the relevant action block (e.g., Fetch Allow List, Fetch Block List).
3. Under Asset, select the asset configured for Infoblox Threat Defense with DDI.

### Configuring Labels for SOC Insights Events

1. In the top-right corner of the Playbook Editor, click **Settings**.
2. Locate **Operates On.**
3. Select the label assigned to SOC Insights events to ensure the playbook runs only on relevant events.

### Vulnerability Management Scan (Automated Playbook)

1. Configure the data path from the artifact that will provide input.
2. The playbook triggers automatically when a new artifact is created.
3. To configure:
  1. Open the "Collect Indicator" code block.
  2. Update the parameter path to match the desired artifact field.
  3. Save the playbook.

### Mark Playbook as Active

In Playbook Settings, toggle the Active switch to enable automated triggering.

### Input Playbooks (IP, Host, MAC, URL Lookups)

In the Data Preview panel (right side of Playbook Editor):

1. Select a manually created event in SOAR for testing.
2. Open the Debugger panel.
3. In Test Inputs, enter the indicator IP/MAC/URL/Host.
4. Click Test.
5. Check the selected event for playbook results.

### Block/Unblock Playbooks

 In the Data Preview panel:

1. Select an existing or manually created SOAR event.
2. Click Save and Run.
3. When prompted on the event page, provide the indicator to be blocked/unblocked.
4. The playbook will execute on that event.

*Notes:*

- *For automated playbooks, verify the trigger conditions (e.g., artifact creation).*
- *For manual execution, ensure the playbook is associated with the correct event label.*
- *Use SOAR debug logs for troubleshooting failed runs.*