A playbook is
A workflow of blocks that runs on an alert: enrich it, correlate it, investigate, decide, stage or execute a response, notify. Playbooks are built in the visual editor on the Playbooks page.
Triggers
| Trigger | Runs on |
|---|---|
| Bound detections | Every alert raised by the rules listed under Fires from detections. A rule can also be bound from the rule editor. |
| Manual | Started by an analyst with Run AI workflow on one or more alerts. |
A playbook with no bound detections runs only when started by hand. A playbook can also be called from another with the Run workflow block.
A run
Every run records its steps, inputs, outputs, verdict and actions. Runs are listed under Playbooks › Runs and on the alert's AI workflow tab. See Runs.
Automation
Response steps run in pre-stage mode, where actions are proposed for a person to confirm, or in auto mode, where they execute on a confident malicious verdict within the organization's guardrails. Wiring a playbook to the close or escalate outcome lets it close or escalate alerts on its own, subject to the same guardrails. See Modes and ceilings.
Start simple
A first playbook for most rules is: Enrich → Correlate → Advisory verdict → Triage note, with no response step and only the queue outcome wired. It costs nothing, produces the verdict on every alert, and shows you what the platform would have done before you let it do it.