Build and manage playbooks

The Playbook designer assists you in creating a playbook graphically based on your incident response or case management scenario.

If you are unfamiliar with Playbook designer, review the descriptions in Playbook designer.

Before you create a playbook, define your goals, processes, conditions to start the playbook, and data flow. The instructions that are presented are for the mechanics of building a playbook, not the actual incident response process.

To access the Playbook designer, click Case Management > Playbooks in the menu bar. The initial page provides a list of all the playbooks and their status.
Note: If you are designing playbooks in an MSSP deployment, create and maintain playbooks in the Provider account and then push the configuration to deploy them to Standard accounts, which is the process by which all customizations are deployed in MSSP deployments. For information about pushing configuration from the Provider account to Standard accounts, see Pushing configuration changes.
To create a playbook, review the following topics.
You can manage playbooks as follows.
  • To edit a playbook, click the name of the playbook in the Playbooks page. Make any changes that are needed. When you save your changes, you might impact any running instances of the playbook. For example, if you change and save a script before the instance runs the script, the playbook uses the updated script. If needed, you can cancel any running instances.
  • To prevent a playbook from running, you can disable the playbook by setting the Enabled toggle to Disabled.
  • To delete a playbook, click its delete icon from the Playbooks page. You can also delete an open playbook by clicking the menu icon in the header and selecting Delete playbook. When you choose to delete playbook, you have a brief amount of time to undo the deletion. If you do not undo the deletion, any unfinished playbook executions are then canceled. If you choose to undo the deletion, any unfinished playbook executions continue to run.
  • You can export your playbooks for use with another Orchestration & Automation application or import a playbook. For more information, see Exporting and importing playbooks.