> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Send Observable Analysis Playbook Request

Submit an observable for security analysis using a specific playbook.

<Note>
  External Documentation

  To learn more, visit the [Intel Owl documentation](https://intelowlproject.github.io/docs/pyintelowl/IntelOwlClass/#docs.Submodules.pyintelowl.pyintelowl.IntelOwl.send_observable_analysis_playbook_request).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter   | Description                                                                                                                                                                                                                                                                                                                                                                                                     |
  | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Observables | An array of observables. Each Observable should be formatted as an array containing the observable classification (url, domain, hash, ip, generic) and its name.<br /><br />For Example:<br /><pre><code>\[<br />  \["url", "[http://google.com/](http://google.com/)"],<br />  \["domain", "example.com"],<br />  \["ip", "8.8.8.8"],<br />  \["hash", "d41d8cd98f00b204e9800998ecf8427e"]<br />]</code></pre> |
  | Playbook    | The name of the playbook to execute for the analysis.                                                                                                                                                                                                                                                                                                                                                           |
  | TLP         | Traffic Light Protocol classification level to control information sharing.                                                                                                                                                                                                                                                                                                                                     |
  | Tags Labels | A comma-separated list of tag labels to assign to the analysis.                                                                                                                                                                                                                                                                                                                                                 |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter                       | Description                                                                                                                                                                                                                                                                                                                                                                                                                            |
  | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Analyzers Runtime Configuration | A configuration object to override default analyzers configuration.<br /><br />For example:<br /><pre><code>\{<br />    "Doc\_Info": \{<br />      "additional\_passwords\_to\_check": \["passwd", "2020"]<br />    }<br />}</code></pre>For more information about the `Runtime Configuration`, refer to [Intel Owl API documentation](https://intelowlproject.github.io/docs/IntelOwl/advanced_usage/#customize-analyzer-execution). |
</div>

## Example Output

```json theme={"dark"}
{
	"results": [
		{
			"job_id": 69,
			"analyzers_running": [
				"AdGuard",
				"Classic_DNS",
				"CloudFlare_DNS",
				"CloudFlare_Malicious_Detector",
				"DNS0_EU",
				"DNS0_EU_Malicious_Detector",
				"DNStwist",
				"Google_DNS",
				"Phishstats",
				"Quad9_DNS",
				"Quad9_Malicious_Detector",
				"Robtex",
				"Thug_URL_Info",
				"Tranco",
				"TweetFeed",
				"UltraDNS_DNS",
				"UltraDNS_Malicious_Detector"
			],
			"connectors_running": [],
			"visualizers_running": [
				"Data_Model"
			],
			"playbook_running": "FREE_TO_USE_ANALYZERS",
			"investigation": 4,
			"status": "accepted",
			"already_exists": false
		},
		{
			"job_id": 70,
			"analyzers_running": [
				"AdGuard",
				"CheckDMARC",
				"Classic_DNS",
				"CloudFlare_DNS",
				"CloudFlare_Malicious_Detector",
				"Crt_sh",
				"DNS0_EU",
				"DNS0_EU_Malicious_Detector",
				"DNStwist",
				"Google_DNS",
				"Mnemonic_PassiveDNS",
				"Onionscan",
				"Phishstats",
				"Quad9_DNS",
				"Quad9_Malicious_Detector",
				"Robtex",
				"Thug_URL_Info",
				"Tranco",
				"TweetFeed",
				"UltraDNS_DNS",
				"UltraDNS_Malicious_Detector"
			],
			"connectors_running": [],
			"visualizers_running": [
				"Data_Model"
			],
			"playbook_running": "FREE_TO_USE_ANALYZERS",
			"investigation": 4,
			"status": "accepted",
			"already_exists": false
		},
		{
			"job_id": 71,
			"analyzers_running": [
				"BGP_Ranking",
				"Classic_DNS",
				"FireHol_IPList",
				"IPApi",
				"IPQuery",
				"Mmdb_server",
				"Mnemonic_PassiveDNS",
				"Phishstats",
				"Robtex",
				"Stratosphere_Blacklist",
				"TalosReputation",
				"TorProject",
				"Tor_Nodes_DanMeUk",
				"TweetFeed",
				"WhoIs_RipeDB_Search"
			],
			"connectors_running": [],
			"visualizers_running": [
				"Data_Model"
			],
			"playbook_running": "FREE_TO_USE_ANALYZERS",
			"investigation": 4,
			"status": "accepted",
			"already_exists": false
		},
		{
			"job_id": 72,
			"analyzers_running": [
				"Cymru_Hash_Registry_Get_Observable",
				"HashLookupServer_Get_Observable",
				"OrklSearch",
				"TweetFeed"
			],
			"connectors_running": [],
			"visualizers_running": [
				"Data_Model"
			],
			"playbook_running": "FREE_TO_USE_ANALYZERS",
			"investigation": 4,
			"status": "accepted",
			"already_exists": false
		}
	],
	"count": 4
}
```

## Workflow Library Example

[Send Observable Analysis Playbook Request with Intel Owl and Send Results Via Email](https://library.blinkops.com/workflows/send-observable-analysis-playbook-request-with-intel-owl-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/send-observable-analysis-playbook-request-with-intel-owl-and-send-results-via-email/canvas" />
</div>
