Incident ResponderRespond to Security Incidents

Table of Contents

Create a Playbook Trigger

For a playbook to run automatically, define which circumstances and conditions trigger the playbook. You define a playbook trigger from the PLAYBOOKS page, or when you create or edit a playbook.

If you manually create an incident, playbooks aren't triggered.Manually Create an IncidentManually Create an Incident

  1. In the navigation bar, click PLAYBOOKS, or create or edit a playbook.

  2. Click Add trigger to playbook.:

    • On the PLAYBOOKS page, select the clock A grey alarm clock. for an existing playbook in the list.

    • If you're creating or editing a playbook, select the clock A grey circle with a white alarm clock in the center..

  3. Click + Trigger.

  4. Select the situation that triggers the playbook:

    • Incident Created – When you create a new incident.

    • Status Changed – When you change the the state of an incident.

    • Priority Changed – When you change the priority of an incident.

  5. To add a condition to the situation, select + Condition. If the situation occurs and the condition is met, the playbook runs. These conditions are based on incident fields, default or custom.Create a Custom Incident FieldCreate a Custom Incident Field

  6. (Optional) To add another condition, click + ADD.

  7. Click SAVE.