Automate your tasks, immediately neutralize attacks, and mitigate damages with Incident Responder playbooks.
A playbook is a standard, repeatable sequence of actions that responds to specific incident types, like phishing or malware, based on your best practices. It automates your workflow and completes complex, manual, and repetitive tasks so you quickly identify and address incidents.
You design a logic flow that triggers the playbook under certain conditions. Then, the playbook automatically runs the relevant responses. You make workflows semi-automated so it runs at the push of a button, or fully automated so it runs without any human intervention.
You manage a playbook and track its history in an incident's workbench.
Define all the terms you encounter when dealing with playbooks.
A scripted task to call a third-party API service and gather data, executed manually or automatically using playbooks. For example: retrieve the reputation information for a given URL or search emails by sender.
You use action nodes in playbooks. It has an inbound port on the left and an outbound on the right.
A node that indicates a boolean (if/else) decision. It has one inbound node on the left, an if/true node on the right, and else/false nodes on the top and bottom.
Data passed from one node to another; data from a Case Manager incident, entity, or artifact.
The fundamental building blocks of playbooks. Each one represents an action, decision, start, or end.
Compares operands and returns a logical value if the comparison is true. Operands may be numerical, string, logical, or object values. Strings are compared based on standard lexicographical ordering, using Unicode values.
Each node has at least one inbound port and one outbound port that connects it to another node (except the start node and end node). An inbound port receives data from another note, and an outbound node sends data.
A third-party product or vendor you integrate with Incident Responder to run actions and playbooks. For example: Cisco Threatgrid, Palo Alto Networks Wildfire. You interact with multiple instances of a service from within Incident Responder. Information about a service, like how to connect to it and which actions are defined, is stored in the Incident Responder server.
Automatically run playbooks using triggers.
Playbooks run automatically if you prescribe it to run under a certain circumstance and that circumstance happens. This circumstance is called a trigger. There are three circumstances that trigger a playbook:
Incident Created – When you create a new incident.
Status Changed – When you change the the state of an incident.
Priority Changed – When you change the priority of an incident.
If you've already created an incident manually and the details match the conditions of a playbook trigger, the playbook will not trigger automatically.