Playbook

Overview

A playbook is a feature that performs automated responses in various situations based on detection scenarios. It runs when an event is detected, a ticket is created, a new indicator is registered, or a user manually runs it. A playbook automatically executes a series of tasks following a predefined procedure.

For example, you can automatically block an attacker's IP address by integrating with security systems such as firewalls. When abnormal traffic is detected and data exfiltration is suspected, the system can investigate the data further and send an alert such as an email to the response team.

The following figure shows the concept of a playbook.

A playbook runs automatically based on configured conditions. Tasks in a playbook execute sequentially or branch into multiple flows. Each task uses input data to perform its work and returns a result, which is passed as input to the next task. The playbook ends when the last task completes.

During playbook execution, tasks that require user judgment send an approval request or prompt users to enter required data. Tasks waiting for user approval are listed under Response > Approval Requests.

Key benefits

Playbooks offer the following advantages.

Response automation

Playbooks automate repetitive security response tasks, reducing the burden on security operations teams. For example, when a specific type of security alert occurs, the system can automatically isolate related systems or analyze malicious files.

Workflow orchestration

Playbooks coordinate workflows across multiple security tools and systems. For example, when an alert is triggered, the system can register it in the ticketing system, conduct additional investigation using a log analysis tool, and report the results to another system.

Standardization of policies and procedures

Playbooks standardize security incident response procedures. This allows all security operations staff to handle incidents in a consistent manner and reduces response time.

Real-time response and analysis

Playbooks enable real-time event analysis and response, minimizing the impact of security incidents and resolving issues quickly.

Reporting and auditing

Playbook execution history is recorded, allowing you to generate reports on the incident response process. Security operations teams can use these reports to evaluate the effectiveness of their response and improve procedures as needed.

Manage playbooks

View and search the playbook list

Go to Policies > Playbooks to view and search the playbook list.

• Start: Run the playbook
• Status: Toggle button to activate or deactivate a playbook (: active, : inactive)
• Start type: The playbook's start type (Manual, Ticket, Event, Indicator)
• Name: The name of the playbook
• Description: A description of the playbook
• Modified At: The date the playbook was created or last modified

To find a specific playbook in the list, use the search tool in the toolbar. The search tool finds playbooks whose Name or Description contains the entered keyword. The search is case-insensitive.

Refresh list

To refresh the playbook list with the latest data, click Refresh in the toolbar.

Import/Export

You can export playbooks to a file or import them from a file. Use this feature to back up or restore playbooks.

To export playbooks:

1. In the playbook list, select the checkboxes of the playbooks you want to export. You can select one or more playbooks.

2. Click Export in the toolbar.

3. In the Export Playbook dialog, set a name and click OK.

   

   • The exported file is saved using the name you entered, with a .json extension appended.

To import playbooks:

1. Click Load in the toolbar.

2. In the Import Playbook dialog, select a playbook file and click OK.

   

   • Select Overwrite duplicated playbook to overwrite an existing playbook that has the same GUID (default: not selected). If you leave it unselected, playbooks whose GUID already exists are skipped, only the others are imported, and the existing playbooks stay unchanged.

Add/edit playbooks

To add or edit a playbook:

1. In the playbook list, click Add in the toolbar to add a new playbook, or click the Name of an existing playbook to edit it.
2. Use the playbook editor to build the playbook.
3. After finishing, click Save or Save and exit in the playbook editor.

Run playbooks

You can run a playbook manually. To start a playbook immediately:

1. In the playbook list, click Start for the playbook you want to run.

   

2. In the Run Playbook modal, enter the input parameters and click OK. If a playbook has no input parameters, no input table is shown; it displays only a run confirmation notice, and clicking OK starts it.

   

   • Show history in a new window after execution: Opens the playbook execution history in a new browser window (default: not selected).
   • The list of input parameters varies depending on the start type of the playbook.

3. You can check playbook execution history under Response > Playbook History.

Duplicate playbooks

Instead of building a playbook from scratch, you can duplicate an existing one and modify it. To duplicate a playbook:

1. Select the checkbox of the playbook row you want to duplicate.
2. Click Duplicate in the toolbar.
3. In the Clone Playbook dialog, confirm the message asking whether to clone the selected playbook, then click OK. Click Cancel to abort.

The duplicated playbook is saved with its name prefixed by Clone of (for example, Clone of Account Takeover Response). Rename it and update its content as needed.

Delete playbooks

To delete a playbook:

1. In the playbook list, select the checkbox of the playbook row you want to delete.
2. Click Delete in the toolbar.
3. In the Delete Playbook dialog, confirm the list of playbooks to delete, then click Delete. Click Cancel to abort.

Playbook version management

When you edit and save a playbook in the playbook editor, the system saves a snapshot of the configuration at the time of saving. This lets you manage versions by storing each changed state of the playbook separately.

View history

To open or close the version history panel, click Versions. Clicking while the panel is closed opens it; clicking while it is open closes it. The panel lists versions by save time, most recent first, and highlights the version currently loaded in the editor. In the following figure, the red box marks the version history panel.

Rollback

Clicking a past version in the version history panel loads that version's playbook configuration and displays it on the flowchart in read-only mode. The toolbar area then shows a Read Only. Start to edit. banner, the save button is hidden, and the top of the screen shows the save timestamp of the loaded version.

Click Start to edit to edit that version. When you save the edited version, it is saved with the current timestamp as a new version, and the playbook runs based on the most recently saved version.

Version tagging

You can assign tags to specific versions in the history and view them separately. Enable Show version if only tag exist in the history panel to list only the versions that have a tag.

To add a tag to a specific version:

1. Click ⋮ on the version you want to tag.
2. Select Add Tag from the options menu.
3. In the Set Tag dialog, enter the tag and click OK.

To edit a tag on a specific version:

1. Click ⋮ on the version whose tag you want to edit.
2. Select Edit Tag from the options menu.
3. In the Set Tag dialog, enter the updated tag and click OK.

To remove a tag from a specific version:

1. Click ⋮ on the version whose tag you want to remove.
2. Select Delete Tag from the options menu.