Build and manage playbooks

The Playbook designer assists you in creating a playbook graphically based on your incident response or case management scenario.

If you are unfamiliar with Playbook designer, review the descriptions in Playbook designer.

Before you create a playbook, define your goals, processes, conditions to start the playbook, and data flow. The instructions that are presented are for the mechanics of building a playbook, not the actual incident response process.

To access the Playbook designer, click Case Management > Playbooks in the menu bar. The initial page provides a list of all the playbooks and their status.

Note: If you are designing playbooks in an MSSP deployment, create and maintain playbooks in the Provider account and then push the configuration to deploy them to Standard accounts, which is the process by which all customizations are deployed in MSSP deployments. For information about pushing configuration from the Provider account to Standard accounts, see Pushing configuration changes.

To create a playbook, review the following topics.

To create a playbook that is activated automatically when a specific condition occurs, see Creating an automatically activated playbook.
To create a playbook that is activated manually by a user, see Creating a manually activated playbook.
After you create the playbook, see Building the playbook to add the customizations, decision points, and flows to the canvas.
To test your playbook, you can create simulations to activate the playbook. Simulations are described in the Simulations.
When you complete the playbook and it is ready to be active, you can publish it as described in Enabling a playbook.

You can manage playbooks as follows.

To edit a playbook, click the name of the playbook in the Playbooks page. Make any changes that are needed. When you save your changes, you might impact any running instances of the playbook. For example, if you change and save a script before the instance runs the script, the playbook uses the updated script. If needed, you can cancel any running instances.
To prevent a playbook from running, you can disable the playbook by setting the Enabled toggle to Disabled.
To delete a playbook, click its delete icon from the Playbooks page. You can also delete an open playbook by clicking the menu icon in the header and selecting Delete playbook. When you choose to delete playbook, you have a brief amount of time to undo the deletion. If you do not undo the deletion, any unfinished playbook executions are then canceled. If you choose to undo the deletion, any unfinished playbook executions continue to run.
You can export your playbooks for use with another Orchestration & Automation application or import a playbook. For more information, see Exporting and importing playbooks.