Which user interface feature allows developers to create logic in a Splunk SOAR playbook?

• A. Playbook toolbar
• B. Playbook canvas
• C. Incident dashboard
• D. Configuration manager

Answer: (B)

The playbook canvas serves as the primary user interface feature that enables developers to create logic in a Splunk SOAR playbook. It provides a visual workspace where developers can drag and drop various actions, decisions, and sequences to construct the workflow of the playbook. This intuitive interface allows for a clear representation of the automation logic, facilitating both the design and debugging processes.

Within the playbook canvas, developers can connect different elements and define the flow of operations that the playbook will execute in response to specific triggers, such as incidents or alerts. This visual approach aids in understanding complex automation processes by presenting them in a structured manner.

While the playbook toolbar may provide tools for managing the playbook or executing specific commands, it is the canvas that specifically allows for the creation and manipulation of the logical flow within the playbook itself. The incident dashboard serves as an operational view of ongoing incidents rather than a development space, and the configuration manager is focused on managing the overall settings and integrations rather than developing individual playbook logic.