Update automation documentation to reflect new capa (authorize members + share + dynamic fields + send via template ) #373

nino-filigran · 2025-10-31T17:19:19Z

Update doc to:

explain component authorize members
ability to have variables in authorized members & share to org
new CTA in query knowledge to add all knowledge in a single bundle
new box to send an email via template
explanation of the dynamic fields in playbook, send an email via template

Update automation page to fix formatting issues (that appears only when reading the doc, but not when previewing it within github)

- extra option on query knowledge - new box for authorize members - explanation of dynamic fields

Files for automation

Update image to show new option in query knowledge + reflect all capa

…hare Clarify database interaction and playbook behavior for sharing and unsharing entities.

marieflorescontact

reviewed for Auth members et Orga sharing part

marieflorescontact · 2025-11-03T09:14:44Z

docs/usage/automation.md

+
+#### Manage Access Restriction
+
+Will apply authorize members on the bundle within the playbook. It is only compatible with entities supporting authorize members (Containers, Drafts).


isn't it compatible also with Organization?
maybe add a link to Auth members documenation OR detail wich containers may be restricetd ?

marieflorescontact · 2025-11-03T09:16:21Z

docs/usage/automation.md

 #### Share with organizations

 Will share every entity in the received STIX 2.1 bundle with Organizations you configured. Your platform needs to have declared a platform main organization in Settings/Parameters.
+You can decice to share only the main triggering element, or the whole bundle thanks to the toogle.


Suggested change

You can decice to share only the main triggering element, or the whole bundle thanks to the toogle.

You can decide to share only the main triggering element, or the whole bundle thanks to the toogle.

marieflorescontact · 2025-11-03T09:18:27Z

docs/usage/automation.md

 #### Share with organizations

 Will share every entity in the received STIX 2.1 bundle with Organizations you configured. Your platform needs to have declared a platform main organization in Settings/Parameters.
+You can decice to share only the main triggering element, or the whole bundle thanks to the toogle.


maybe add a link to organization segreagation doc

marieflorescontact · 2025-11-03T09:21:39Z

docs/usage/automation.md

 Will share every entity in the received STIX 2.1 bundle with Organizations you configured. Your platform needs to have declared a platform main organization in Settings/Parameters.
+You can decice to share only the main triggering element, or the whole bundle thanks to the toogle.
+
+Compared to other components, this component **makes direct call to the database**: this means that the query will be applied before the "send to ingestion" step. As a result, if, **wthin the same playbook**, you attempt to create a new entity (via the wrap in container step) and share the entity, the playbook will fail. Indeed, the entity will not yet be created, since it won't be sent to ingestion yet. You need to share the entity in another playbook to achieve this use case.


I find this part functionally difficult to understand. (and I don't know how to give a better explaination 🙃)

marieflorescontact · 2025-11-03T09:23:32Z

docs/usage/automation.md

+
+**This component supports dynamic variables**
+
+- Dynamic from the main enity triggering the playbook: Will remove the authorize members on the coresponding user of the field you chose, based on the triggering entity only. You can chose among:


Suggested change

- Dynamic from the main enity triggering the playbook: Will remove the authorize members on the coresponding user of the field you chose, based on the triggering entity only. You can chose among:

- Dynamic from the main enity triggering the playbook: Will remove the authorized members on the coresponding user of the field you chose, based on the triggering entity only. You can chose among:

marieflorescontact · 2025-11-03T09:24:03Z

docs/usage/automation.md

+
+#### Manage Access Restriction
+
+Will apply authorize members on the bundle within the playbook. It is only compatible with entities supporting authorize members (Containers, Drafts).


Suggested change

Will apply authorize members on the bundle within the playbook. It is only compatible with entities supporting authorize members (Containers, Drafts).

Will apply authorized members on the bundle within the playbook. It is only compatible with entities supporting authorize members (Containers, Drafts).

well not sure, but don't we always says authorized? (with a "d")

marieflorescontact · 2025-11-03T09:25:43Z

docs/usage/automation.md

+   - Participant: Will remove all users in participant field from the authorize members.
+
+ - Dynamic from the object in the bundle of the playbook: will remove the authorize members on all the corresponding users of all the entities contained in your bundle and not only the triggering entity. 
+    - Organization: all users belonging to the organizations in your bundle will be remove from authorize members.


Suggested change

- Organization: all users belonging to the organizations in your bundle will be remove from authorize members.

- Organization: all users belonging to organizations in your bundle will be removed from authorizde members.

marieflorescontact · 2025-11-03T09:26:30Z

docs/usage/automation.md

+ - Dynamic from the object in the bundle of the playbook: will remove the authorize members on all the corresponding users of all the entities contained in your bundle and not only the triggering entity. 
+    - Organization: all users belonging to the organizations in your bundle will be remove from authorize members.
+
+**The component also support static fields, used for authorize members: users, groups & organizations.**


Suggested change

**The component also support static fields, used for authorize members: users, groups & organizations.**

**The component also support static fields, used for authorized members: users, groups & organizations.**

OctaveLaventure

I recommend using an AI to proof-read in addition to my review, I probably missed some typos

OctaveLaventure · 2025-11-03T08:55:13Z

docs/usage/automation.md

+|  Listen knowledge events, Manual enrollment, Query knowledge on regular basis, Match knowledge, Reduce knowledge, Manipulate knowledge | Creator                                | verify that you have existing users in your platform                                          | create it   |
+|  Enrich through connector                                                                                                              | Connector                              |  Connector exists in your platform                                                            | create it   |
+|  Container wrapper                                                                                                                     | Task template                          |  Task template exists in your platform                                                        | create it   |
+|  Send to notifier                                                                                                                      | Notifier                               |  Notifer exists in your platform                                                              | create it   |


"Notifer" → "Notifier"

OctaveLaventure · 2025-11-03T08:58:37Z

docs/usage/automation.md

 #### Share with organizations

 Will share every entity in the received STIX 2.1 bundle with Organizations you configured. Your platform needs to have declared a platform main organization in Settings/Parameters.
+You can decice to share only the main triggering element, or the whole bundle thanks to the toogle.


"decice" → "decide"
"toogle" → "toggle"

OctaveLaventure · 2025-11-03T08:59:13Z

docs/usage/automation.md

 Will share every entity in the received STIX 2.1 bundle with Organizations you configured. Your platform needs to have declared a platform main organization in Settings/Parameters.
+You can decice to share only the main triggering element, or the whole bundle thanks to the toogle.
+
+Compared to other components, this component **makes direct call to the database**: this means that the query will be applied before the "send to ingestion" step. As a result, if, **wthin the same playbook**, you attempt to create a new entity (via the wrap in container step) and share the entity, the playbook will fail. Indeed, the entity will not yet be created, since it won't be sent to ingestion yet. You need to share the entity in another playbook to achieve this use case.


"makes direct call" → "makes a direct call" or "makes direct calls" or "directly calls"
(I put only one comment but it should be fixed in other places too)

OctaveLaventure · 2025-11-03T09:00:49Z

docs/usage/automation.md

+#### Unshare with organizations
+
+Will unshare every entity in the received STIX 2.1 bundle with Organizations you configured. Your platform needs to have declared a platform main organization in Settings/Parameters.
+You can decice to unshare only the main triggering element, or the whole bundle thanks to the toogle.


"decice" → "decide"
"toogle" → "toggle"

OctaveLaventure · 2025-11-03T09:02:22Z

docs/usage/automation.md

+
+#### Manage Access Restriction
+
+Will apply authorize members on the bundle within the playbook. It is only compatible with entities supporting authorize members (Containers, Drafts).


"authorize members" → "authorized members" everywhere in the file ?

OctaveLaventure · 2025-11-03T09:19:57Z

docs/usage/automation.md

-![Querying last incidents](assets/playbook_query_regular.png)
+##### Specificities of the component
+
+**Include all entities in a signel bundle**: this options allows you to add all entities found in a single bundle. This is useful if you want for instance to send a single email containing multiple entities at once.


"signel" → "single"

OctaveLaventure · 2025-11-03T09:25:39Z

docs/usage/automation.md

+#### Manage Access Restriction
+
+Will apply authorize members on the bundle within the playbook. It is only compatible with entities supporting authorize members (Containers, Drafts).
+You can decide to only apply restriction on the triggering element or the whole bundle by enabling the toggle.


"apply restriction" -> "apply restrictions" or "apply a restriction" here and in other places too

OctaveLaventure · 2025-11-03T09:26:32Z

docs/usage/automation.md

+You can decide to only apply restriction on the triggering element or the whole bundle by enabling the toggle.
+
+##### Specificities of the component
+Compared to other components, this component **makes direct call to the database**: this means that the query will be applied before the "send to ingestion" step. As a result, if, **wthin the same playbook**, you attempt to create a new entity (via the wrap in container step) and apply authorize members, the playbook will fail. Indeed, the entity will not yet be created, since it won't be sent to ingestion yet. You need to apply the authorize members in another playbook to achieve this use case.


"wthin" → "within" here and in all other occurrences

OctaveLaventure · 2025-11-03T09:27:34Z

docs/usage/automation.md

+
+**This component supports dynamic variables**
+
+- Dynamic from the main enity triggering the playbook: Will remove the authorize members on the coresponding user of the field you chose, based on the triggering entity only. You can chose among:


"enity" -> "entity"

OctaveLaventure · 2025-11-03T09:28:01Z

docs/usage/automation.md

+   - Participant: Will remove all users in participant field from the authorize members.
+
+ - Dynamic from the object in the bundle of the playbook: will remove the authorize members on all the corresponding users of all the entities contained in your bundle and not only the triggering entity. 
+    - Organization: all users belonging to the organizations in your bundle will be remove from authorize members.


"will be remove" → "will be removed"

Revise automation.md for clarity on playbook steps

161faa9

Update automation page to fix formatting issues (that appears only when reading the doc, but not when previewing it within github)

nino-filigran added the do not merge label Oct 31, 2025

nino-filigran added 3 commits October 31, 2025 18:46

Add new capabilties & dynamic fields

402dfbe

- extra option on query knowledge - new box for authorize members - explanation of dynamic fields

Add files via upload

fbf312a

Files for automation

Update images in automation.md

f2cb2b3

Update image to show new option in query knowledge + reflect all capa

nino-filigran linked an issue Oct 31, 2025 that may be closed by this pull request

Playbooks new capabilities #342

Open

nino-filigran removed the do not merge label Oct 31, 2025

Sepcific beahvior (api call direct) for Authorize members & share uns…

802358b

…hare Clarify database interaction and playbook behavior for sharing and unsharing entities.

marieflorescontact reviewed Nov 3, 2025

View reviewed changes

OctaveLaventure reviewed Nov 3, 2025

View reviewed changes

marieflorescontact added the filigran team label Nov 7, 2025


		#### Manage Access Restriction

		Will apply authorize members on the bundle within the playbook. It is only compatible with entities supporting authorize members (Containers, Drafts).

	You can decice to share only the main triggering element, or the whole bundle thanks to the toogle.
	You can decide to share only the main triggering element, or the whole bundle thanks to the toogle.


		This component supports dynamic variables

		- Dynamic from the main enity triggering the playbook: Will remove the authorize members on the coresponding user of the field you chose, based on the triggering entity only. You can chose among:

	Will apply authorize members on the bundle within the playbook. It is only compatible with entities supporting authorize members (Containers, Drafts).
	Will apply authorized members on the bundle within the playbook. It is only compatible with entities supporting authorize members (Containers, Drafts).

	- Organization: all users belonging to the organizations in your bundle will be remove from authorize members.
	- Organization: all users belonging to organizations in your bundle will be removed from authorizde members.

	The component also support static fields, used for authorize members: users, groups & organizations.
	The component also support static fields, used for authorized members: users, groups & organizations.

Update automation documentation to reflect new capa (authorize members + share + dynamic fields + send via template ) #373

Are you sure you want to change the base?

Update automation documentation to reflect new capa (authorize members + share + dynamic fields + send via template ) #373

Uh oh!

Conversation

nino-filigran commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marieflorescontact left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

OctaveLaventure left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nino-filigran commented Oct 31, 2025 •

edited

Loading

marieflorescontact left a comment •

edited

Loading