Automation ManagementAutomation Management Guide

A playbook is a standard, repeatable sequence of actions that automates complex, manual, and repetitive tasks.

A playbook runs automatically or manually. A playbook runs automatically when it's triggered by a certain situation. Playbooks with the same trigger run in an order you specify. You can also manually run a playbook on a Threat Center case or alert. Playbooks run automatically or manually against a case or alert are recorded in the case or alert history.

There are two types of playbooks: rule-based and advanced. Rule-based playbooks automate simple workflows in which a trigger object and its properties directly correlate to actions. Advanced playbooks automate complex workflows with advanced conditional logic, multiple decision branches, and configurable actions.

You can access playbooks through Automation Management in the Playbooks tab. Playbooks are organized by trigger object. You can further filter playbooks and search for playbooks.

By default, there are 13 pre-built playbooks. You can also create your own rule-based or advanced playbook. After you create a playbook, you can reorder, edit, clone, disable, or delete them or preview its details before making any changes.Preview Automation Management Playbook Details