Skip to main content

Incident ResponderIncident Responder Documentation

Version: i56

Create a Playbook

Create a playbook to automate your workflow, and respond more quickly and efficiently to attacks.

  1. Ensure you're familiar with the logic of compound, relational, and conditional operators.

  2. Navigate to the PLAYBOOKS page.

  3. Click Add a new playbook A blue circle with a white plus sign..

  4. Enter information about the playbook:

    • Playbook template – Choose a template from the list. To create an empty playbook, select New Playbook.

    • Name – Give your playbook a unique name.

    • (Optional) Description – Describe your playbook, what it does, and when it should be used.

  5. Click Create. The playbook contains a start node and end node. If you selected a template, the playbook contains other nodes based on the template.

  6. Define the logic of your playbook: add a node, and configure action, decision, or filter nodes. As you design your playbook, keep in mind:

    • All nodes must be linked in some way to the start and end node; otherwise, you can't run the playbook.

    • You can only use the output from the previous node as an input for the next node.

    • You can use the output of one node in another only if the latter node takes in data of the same type. For example, if one node outputs a list of URLs, you can't link it to a node that takes in a list of IP addresses.

    • You must configure all necessary input fields for a given node. If you haven't configured one or more necessary fields, the node is outlined in red.

    • You can run up to 80 action nodes simultaneously.

  7. Click Save A grey circle with a white floppy disk in the middle.. You may save your playbook at any time, but if it contains an error, it won't run and is disabled by default. Your playbook appears in the list on the PLAYBOOKS page.