Cloud-delivered Incident ResponderIncident Responder Documentation

In the playbook editor, you create and edit playbooks.

This is a new example playbook. Let's explore this playbook:

1 Control how you view the interface. Zoom in, out, or reset the view to the default.

2 A playbook is made of nodes. You connect each node to one or more other nodes. Each node has two or more ports, inbound and outbound. To view a node's ports, hover over the node.

3 Add a playbook trigger.

4 Save your playbook and return to the PLAYBOOKS page. You can save your playbook even if it's incomplete, but if it contains any errors, it will not run.

Every playbook has a start node and end node that defines its logical boundaries, where the playbook starts and ends. You cannot change these two nodes. The start node has one outbound port; the end node has one inbound port.

To build the logic of your playbook, add nodes, and configure action, decision, and filter nodes.

If a node is outlined in red, it needs your attention. When you create a playbook using a template, all the nodes are initially outlined in red. You must click on the node and change how it's configured or the playbook will not run.