The canvas
Add blocks from the palette on the left. Connect them by clicking the handle on one block and then another; right-click a connection to remove it. Wire the flow from Trigger through your steps into the outcomes on the right: queue (the default), recommend close, escalate to a case, or isolate the host. Each block has a configuration panel on the right.
A playbook needs a name and at least one step before it can be saved.
Triggers
Fires from detections in the palette lists the rules that start the playbook. Search rules… adds or removes them.
Before you enable
A new playbook is easiest to trust when it starts with no response step and only the queue outcome wired. Watch its runs under Playbooks › Runs for a few days, then add responses in pre-stage mode, and only later in auto mode.
Permissions
Editing playbooks needs the detections permission of your role. See Users and roles.