An Input playbook is the appropriate playbook type when the workflow must be invoked directly from Splunk Mission Control or Enterprise Security. Input playbooks are designed with an externally supplied input interface so that another Splunk security product can provide the data required by the playbook at invocation time.
This distinction matters because externally initiated playbooks need a defined contract describing what values the calling system passes into the workflow. Mission Control or Enterprise Security may provide information associated with the finding, event, entity, indicator, or investigation. The Input playbook can then use those supplied values for enrichment, investigation, containment, or other automated actions.
A generic Automation playbook is focused on orchestration logic but does not represent the specific external invocation model being tested. “Process” and “Response” are distractors in this context and do not identify the required playbook type.
Architecturally, Input playbooks help decouple the upstream detection platform from SOAR implementation details: Enterprise Security identifies the security condition and passes structured information, while SOAR executes the automated workflow.
Study Guide topics: Splunk SOAR playbook types; Input playbooks; Mission Control integration; Enterprise Security integration; external playbook invocation.
