Add an Integration

An integration step allows your playbook to interact with other systems or tools to bring in external information about threats. When you add an integration to a playbook, you must specify an integration connection. The integration connection identifies the external system and provides authentication and any other configuration parameters.

Integration connections don't depend on a particular playbook. They can be reused and shared with others. To view and manage the current list of integration connections, use the content library.

Note: To view or set up integration connections, you must be in a group that has Integration Connection permission. For more information, see Manage users.

1. In the playbook editor, hover over the parent step and click +.
2. Under ‘What do you want to automate?’, click Integration to filter the list, and find the integration you want to add.
3. Select an existing connection for the integration or click Create a New Instance. For a new instance, enter information to identify and authenticate to the external system. The required information depends on the selected integration. For details, see the topic on the particular integration in this help system. Search for the integration by name or browse under Integrations in the help menu.
4. Click Next.
5. Select a column name from the parent table as the input for this step.
   For the Select Column name field, you can specify a function, field, or constant value to report as the output of the step. The process is the same as for the add fields automation. See Add field values to the results table in Easy Mode.
6. Click Save to save the settings and add the step to the playbook.