The canvas
Blocks are added from the palette on the left and connected top to bottom. Each block has a configuration panel on the right. Branch and gate blocks split the flow; everything else is linear.
Testing
Test with alert runs the playbook against an existing alert in a scratch scope: enrichment and queries run for real, but actions are only reported, not executed, and no notification is sent. The test trace looks exactly like a real run trace.
Versions
Saving a playbook creates a new version. Runs record the version they used. Rolling back is selecting an older version as current.
Bindings
The Bindings tab lists the rules, severities, sources and tags that trigger the playbook, and the organizations it applies to. A playbook can be scoped to one organization or all; per-organization ceilings still apply.
Permissions
Leads and admins edit playbooks. Analysts can run manual playbooks and confirm staged actions. Viewers can read run traces.