The VPE allows you to create a playbook using function blocks and connectors, which describe the order of operation. When creating a new block, you’re presented with all possible function block types as the next step in your playbook. You’re able to: define a security action to execute, filter data, make a decision using encoded logic, prompt a user for input or confirmation, call another playbook, and more.

Playbook Canvas & Function Blocks
Function Configuration Panel


When you create a new function block, the VPE interface presents a context-aware configuration panel that guides you through setting up the parameters that apply to the function block type you selected. The Phantom Platform is also aware of your configured Apps and Assets, including the data types they accept. This context speeds the playbook building process and simplifies configuration options.


In addition to its graphical playbook tools, the Phantom VPE also includes a Python playbook editor and debugger. This allows you to work graphically, completely in code, or in a hybrid mode between the two. This flexibility allows all users to author Phantom Playbooks the way they choose.

Python Playbook Editor & Playbook Debugger
Playbook Draft & Safe Mode


Draft mode enables you to override the VPEs missing Asset warnings during playbook creation. Enabling Safe Mode allows you test your playbook’s logic to identify and troubleshoot issues. Safe mode disables write commands issued to Assets in your environment. Once you’re confident that the playbook is functioning correctly, you can move to the normal mode of operation, effectively moving the playbook into production.


The Phantom Platform maintains full revision control using Git repositories for all Phantom Playbooks. This allows you to easy view, compare, and rollback changes made to playbooks if necessary. The revision history and revision control also helps with auditing user activity on the platform.

Playbook Revision History

Learn More About the Phantom Platform

Mission Control