Action EditorAction Editor Documentation

Action Editor is an application available for free on Exabeam SOC Platform to all Incident Responder users. It guides you through the process to customize an out-of-the-box service and actions or create your own custom service and actions from scratch.

You might consider creating a custom service or action if you can't build a specific workflow in a Incident Responder playbook using just out-of-the-box actions. For example, when you create a playbook, you can use an output of one node as an input for another node only if it takes in data of the same type. With Action Editor, you can change an action's inputs and outputs, or add more inputs and outputs, to ensure playbook nodes map together. You can also add more actions to an out-of-the-box service; create a service Incident Responder doesn't currently support so you get started quickly without waiting for Exabeam to develop it; or build other services and actions to fit your team's specific needs.

After you create a service or action in Action Editor, download a ZIP file, then upload it to Incident Responder. Your custom service and action is available for you to run manually or use to create your perfect playbook. To upload a service you created in Action Editor, you must have Incident Responder i53 or later.