The primary objective of using the I2A2 playbook design methodology in Splunk SOAR is to create
playbooks that are simple, reusable, and modular. This design philosophy emphasizes the creation of
playbooks that can be easily understood and maintained, encourages the reuse of playbook
components in different scenarios, and fosters the development of playbooks that can be modularly
connected or used independently as needed.
I2A2 design methodology is a framework for designing playbooks that consists of four components:
•
Inputs: The data that is required for the playbook to run, such as artifacts, parameters, or
custom fields.
•
Interactions: The blocks that allow the playbook to communicate with users or other
systems, such as prompts, comments, or emails.
•
Actions: The blocks that execute the core logic of the playbook, such as app actions, filters,
decisions, or utilities.
•
Artifacts: The data that is generated or modified by the playbook, such as new artifacts,
container fields, or notes.
The I2A2 design methodology helps you to plan, structure, and test your playbooks in a modular and
efficient way. The primary objective of using the I2A2 design methodology is to create simple,
reusable, modular playbooks that can be easily maintained, shared, and customized. Therefore,
option D is the correct answer, as it states the primary objective of using the I2A2 design
methodology. Option A is incorrect, because creating detailed playbooks is not the primary objective
of using the I2A2 design methodology, but rather a possible outcome of following the framework.
Option B is incorrect, because creating playbooks that customers will not edit is not the primary
objective of using the I2A2 design methodology, but rather a potential risk of not following the
framework. Option C is incorrect, because meeting customer requirements using a single playbook is
not the primary objective of using the I2A2 design methodology, but rather a challenge that can be
overcome by using the framework.
1: Use a playbook design methodology in Administer Splunk SOAR (Cloud).