@Ka2 I would suggest you to review logs under /var/log/phantom/ especially playbook.log, for parsing or sync errors. Could you confirm whether you’ve tried importing the playbook via the Playbook Editor or registering it through the REST API? Instead of manual placement of file, can you try to import the playbook by using the /rest/import_playbook API as described in the documentation, or use the Import Playbook icon in the Splunk SOAR user interface. This ensures that the playbook is properly processed and configured in the system.  Ref: REST Playbook | Splunk Enterprise, Splunk Cloud Platform (last updated 2026-02-04T21:29:11.870Z) Export and import playbooks in Splunk SOAR (Cloud) | Splunk Enterprise, Splunk Cloud Platform (last updated 2026-02-04T21:30:34.086Z) >> If this post addressed your question, you can: Give it karma to show appreciation 👍 Mark it as the solution if it solved your issue ✔️ Add a comment if you’d like more details ✏️ Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise. >> ... View more