Skip to main content

Cloud-delivered Incident ResponderIncident Responder Documentation

Create a Playbook

Create a playbook to automate your workflow, and respond more quickly and efficiently to attacks.

You can create your own playbook only if you're assigned an Incident Responder seat. If you aren't assigned an Incident Responder seat, you can only use turnkey playbooks.

  1. Ensure you're familiar with the logic of compound, relational, and conditional operators.

  2. In the sidebar, click PLAYBOOKSA grey arrow pointing right.

  3. Click Add a new playbookA dark blue plus sign..

  4. Enter information about the playbook:

    • Playbook template – Choose a template from the list. To create an empty playbook, select New Playbook.

    • Name – Give your playbook a unique name.

    • (Optional) Description – Describe your playbook, what it does, and when it should be used.

  5. Click Create. The playbook contains a start node and end node. If you selected a template, the playbook contains other nodes based on the template.

  6. Define the logic of your playbook: add a node, and configure action, decision, or filter nodes. As you design your playbook, keep in mind:

    • All nodes must be linked in some way to the start and end node; otherwise, you can't run the playbook.

    • You can only use the output from the previous node as an input for the next node.

    • You can use the output of one node in another only if the latter node takes in data of the same type. For example, if one node outputs a list of URLs, you can't link it to a node that takes in a list of IP addresses.

    • You must configure all necessary input fields for a given node. If you haven't configured one or more necessary fields, the node is outlined in red.

    • You can run up to 80 action nodes simultaneously.

  7. Click SaveA dark blue floppy disk.. You may save your playbook at any time, but if it contains an error, it won't run and is disabled by default. Your playbook appears in the list on the PLAYBOOKS page.