Add or Remove Event Types

An event type specifies a query to run against the data from your connections. Each playbook begins with one or more event types, which are displayed with a gray header. In our example playbook, the PanThreat event type reads in all the data from the source.

For event types, the query area is read-only. To change the event type, you must edit the event type. Select Data > Event Types.

To add or remove an event type, click Add/Remove Event Types at the top of the page. Select the event types to include in your playbook, and click Done. If you don't see the event type you'd like to include, click Create a new Event Type. Each event type you add becomes a starting step for a portion of your playbook.