Skip to content
Run the automated phishing response playbook flow › Playbook for Automated Phishing › Flow-based Playbooks › Security Incident Response playbooks › Playbook Resources › Security Incident Response › Enterprise security case management applications › Security Operations
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

View automated phishing response playbook flow action designer

You can drill down to the Action Designer to view detailed information about the actions being performed for a specific step in the automated phishing response playbook flow.

This page describes the Action Designer page for the Get Observables from Task step. Select a task in the Action Outline panel to view the details.

Action Input

This section shows details on how the action was created including the incident id, the type of observable (hash or IP) and observable finding (malicious emails only).

Image omitted: cj-sir-flow-phishing-action5-1.png
Automated phishing playbook flow: action designer inputs

Get M2M Records

This section shows the conditions that have been defined to search for observables in a specified table.

Image omitted: cj-sir-flow-phishing-action5-2.png
Automated phishing playbook flow: action designer get records

Get Observables

This section shows the script used to retrieve observables based on the specified filter conditions. Finally, the observables meeting this criteria and the count is displayed.

Image omitted: cj-sir-flow-phishing-action5-3.png
Automated phishing playbook flow: action designer get observables

Note: All actions defined in this flow are reusable and can be modified according to your requirements.

Parent Topic:Run the automated phishing response playbook flow