Automation ManagementAutomation Management Guide

A playbook is a standard, repeatable sequence of actions that automates complex, manual, and repetitive tasks.

A playbook runs when it's triggered by a certain situation. If the trigger object meets specific conditions, the playbook automatically executes an action. Actions executed against a case or alert are recorded in the case or alert history. Playbooks with the same trigger run in an order you specify.

You can access playbooks through Automation Management or Threat Center. In Threat Center, navigate to the Playbooks tab.

Playbooks are organized by triggers. You can filter playbooks by trigger object. By default, there are 13 pre-built playbooks. You can also create your own playbook. To create a playbook, you define the playbook trigger, what conditions the trigger object must meet, and actions the playbook executes if the conditions are true. After you create a playbook, you can reorder, edit, clone, disable, or delete them.