Glossary: Security Monitoring and Automation

playbook

Also written: playbooks, response playbook

In Ansible, a YAML file of named tasks that describes a desired state, like blocklist.yml. In SOAR, the steps a machine follows when an alert arrives (check, decide, act, record), like respond.sh.