Playbook All on Content Hub
Ask an analyst before blocking
Pauses for analyst approval, then acts on the response.
@ftnt-dspilleMaintainer v1.0.0 Platform 7.4.0+ Published Sep 15, 2026
Download JSON · 6.0 KB
approve-before-block.json
sha256:a834d8c4657b4ebc11f7a352256f283559f633a499df0c494deb0c498e9f40a6
Sanitized by the pipeline and shipped inactive. Follow the before turning it on.
A human-in-the-loop pattern: the playbook presents a manual input asking the analyst to approve a block and then follows the branch matching their answer. Drop your containment step into the approve branch.
Something wrong with this item? Sign in to report