The following article explains the various modules available in the Playbook Canvas.All modules are based on dynamic parameters: Parameters that their value is calculated at runtime, individually for every playbook run.All operations include the field Display Name, which is the name of the step as it appears on the Canvas and in the Incident View. Enter a descriptive name so you can easily follow the flow of the playbook.Most operations include the field Result Name, to help you recognize the results of the specific step further down in the investigation (will appear as dynamic parameters under the Display Name). ModuleInput FieldsOutput FieldsQueries File Action Query:Investigate actions using data collected by Cynet File Monitoring.File Action: Select from the list of actions that can be performed by a process. For information on the different actions, see Investigating Processes.Search Params: Define the file attributes that you want to investigate. AND is applied between parameters. List of found File Monitor actions. To drill into the parameters of those actions, use the Iterator. For the list of available parameters, click here.Get Related Alerts: Get other alerts associated with a specified entity Type: Select the entity for which to get the associated alerts: File SHA256, IP or domain, or host nameEntity value: after selecting type, specify the exact value. List of alerts associated with the entityGet File Instances: get a list of all the endpoints on which the file existsFile SHA256List of endpoints on which the file existsGet Child Processes: Gets all the child processes spawned by the specified process instanceProcess Occurrence IDlist of child processesGet connections: Get all the sockets opened by a specified processProcess Occurrence IDList of sockets opened by the processOperatorsIterator:Perform the next operation in the flow on a list of objects. Every step below this field is repeated for every object in the list.  Iterate On: Define the array on which to perform the next investigation steps.The list of fields within each array objectCondition:Set a condition to determine the rest of the flow. Param Name: The parameter within the collected result that you want to continue investigatingOperator Value True or falseParse JSON: Parse a JSON string to use specific items from it in the investigationThe JSON string (typically the response of an API call)The items you want to retrieve from the JSONSpecific JSON itemsActionsAdd Finding:Mark an artifact as a malicious finding. Findings are displayed in the Incident View, where you can take action on them. Type: Select the type of object that is the result of the investigation Resource: Enter the parameter to display as the investigation findingReason: Enter a conclusion for your investigation, i.e. why the findings are malicious. You can also include dynamic parameters.NARemediation Action: Perform a Cynet built-in remediation action Host Name: Enter the name of the endpoint on which the action is performed. File, user, and network actions require additional input about the entity.NASend Email: Send an automated email with investigation findings to selected recipients Recipient Name: The address of the email recipient Subject: The subject of the email that is sent Message: The body of the email that is sentNAAdd Comment to AlertAlert IDCommentNAClose Alert: Change alert status to ClosedAlert IDNA