The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Execute SOAR playbooks from Trellix ESM

  • Published on Sep 12, 2026
  • 1 minute(s) read
Prev Next

You can execute the SOAR playbooks from Trellix ESM and view the executed playbook details in Trellix Security Orchestrator and respond to the incidents.

Make sure the Device Actions privilege is enabled from System Properties.

  1. From the Trellix ESM dashboard, click menu.png and select More Settings.

  2. Select Event Views → Event Analysis, then select an event.

  3. Click GUID-90CC508D-C258-41AB-9D9C-4E1D7DE5FBCB-low.png and select Actions → Execute SOAR Playbook.GUID-766500D6-07FE-4F3F-B513-8A5E5DDBE4E7-low.png

  4. Select Prepare Playbook and click Execute.

  5. In the SOAR Response pop-up window, click SOAR Response.

The SOAR playbook is executed successfully.

Related articles
  • Execute SOAR playbooks from Trellix ESM
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > Responding to threats > Integrate Trellix ESM with Trellix Security Orchestrator
  • Add SOAR playbooks to Trellix ESM
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > Responding to threats > Integrate Trellix ESM with Trellix Security Orchestrator
  • Add SOAR playbooks to Trellix ESM
    Enterprise Security Manager > Enterprise Security Manager 11.6.x > ESM 11.6.x Product Guide > Responding to threats > Integrate Trellix ESM with Trellix Security Orchestrator