A playbook is
A workflow of blocks that runs on an alert: enrich it, correlate it, investigate, decide, stage or execute a response, notify. Playbooks are built in the visual editor under Detections › Workflows and bound to detections by rule, by minimum severity, by source or by tag.
Triggers
| Trigger | Runs on |
|---|---|
| Bound rule | Every alert the rule raises. |
| Minimum severity | Every alert at or above the severity in the organization. |
| Source | Every alert whose events came from the source. |
| Tag | Every alert carrying the tag. |
| Manual | Queued by an analyst from the alert page. |
A playbook can also be called from another playbook with the Run workflow block.
A run
Each run has a deterministic identifier from the alert and the playbook version, so the same alert does not run the same playbook twice. The run's steps, inputs, outputs and any actions are recorded and shown under Response › Playbook runs and on the alert's AI tab. See Runs.
Modes
A playbook runs in pre-stage mode, where actions are proposed and a person confirms them, or in auto mode, where actions execute on a confident-malicious verdict within the organization's ceiling. See Modes and ceilings.
Start simple
A first playbook for most rules is: Enrich → Correlate → Advisory verdict → Triage note, in pre-stage mode with no response block. It costs nothing, produces the verdict on every alert, and shows you what the platform would have done before you let it do it.