Skip to main content

Automation ManagementAutomation Management Guide

Pre-Built Automation Management Playbooks

Fully pre-configured playbooks are ready to run without you having to create your own playbook.

Pre-built playbooks are playbooks that are already configured and enabled by default. They're listed along other playbooks in Automation Management. There are 13 pre-built playbooks.

Six pre-built playbooks with the alert is created trigger are in the following order by default:

  1. Create Case – if an alert is created, and its risk score is 90 or higher, a case is created from the alert.

  2. Set Alert Priority to Low – if an alert is created, and its risk score is less than 60, its priority is changed to Low.

  3. Set Alert Priority to Medium – if an alert is created, and its risk score is greater than or equal to 60 and less than 80, its priority is changed to Medium.

  4. Set Alert Priority to High – if an alert is created, and its risk score is greater than or equal to 80 and less than 90, its priority is changed to High.

  5. Set Alert Priority to Critical – if an alert is created, and its risk score is greater than or equal to 90, its priority is changed to Critical.

  6. Create Correlation Case – If a correlation rule outcome is defined to create a Threat Center case, Automation Management creates a case.

Six pre-built playbooks with the alert is modified trigger are in the following order by default:

  1. Create Case – if an alert is modified and its risk score is 90 or higher, a case is created from the alert.

  2. Set Alert Priority to Low – if an alert is modified, and its risk score is less than 60, its priority is changed to Low.

  3. Set Alert Priority to Medium – if an alert is modified, and its risk score is greater than or equal to 60 and less than 80, its priority is changed to Medium.

  4. Set Alert Priority to High – if an alert is modified, and its risk score is greater than or equal to 80 and less than 90, its priority is changed to High.

  5. Set Alert Priority to Critical – if an alert is modified, and its risk score is greater than or equal to 90, its priority is changed to Critical.

  6. Create Correlation Case – If a correlation rule outcome is defined to create a Threat Center case, Automation Management creates a case.

There is one pre-built playbook whose trigger is case is created. For the Set Default Case Assignee/Queue playbook, if a case is created and its risk score is greater than or equal to 90, it's assigned to the Tier 1 Analyst queue.

You can disable and reorder pre-built playbooks; you can't delete them.

If you don't want to use these pre-built playbooks, create your own playbook from scratch or clone a pre-built playbook to use as a starting point for a new playbook.