Use predefined widgets in playbook views

Predefined widgets ready-made widgets linked to actions in integrations from the Google Security Operations Marketplace. Created by Google SecOps experts, these widgets provide specific information for actions, saving time on customizing and building a playbook view.

After you download the integration, the actions appear as usual when creating a playbook, with special icons that indicate predefined widgets. 

You can use these widgets in existing playbooks or when creating new ones.

Build a new playbook view with predefined widgets

1. Go to Google SecOps Marketplace > Integrations and select VirusTotal.
2. Click Read More. As you can see, some of the VT actions come with predefined widgets:
   
3. Download and configure the VirusTotal integration as required.
4. Go to the Playbooks screen and explore how to use an action with a predefined widget.
5. Create a new playbook, open the Step Selector and drag the VirusTotal Enrich hash action.
6. Click Add View and give it a name (contains VirusTotal widgets) and choose a role. In this example, leave the checkbox selected to include predefined widgets. You can choose to opt out or remove them later after creating the view.
   
7. After you create the view, the widget is automatically added to the view. You can only edit these options in this widget: Name, Description, Conditions.
   
8. After the playbook is attached to an alert, it appears in the Alert view in the Playbook tab of the case.
   

Add predefined widgets to an existing playbook

1. Locate the required Playbook and open the Step Selection.
2. Drag the VirusTotal Enrich URL action into the playbook, and click Save.
3. Open the view, where you can see the predefined widget in the Predefined column on the left.
4. Drag it into the view.