My Second Playbook

LAST UPDATED: JAN 8, 2024

Event playbooks (now preprocessing playbooks) are used to automate preparatory tasks—normalizing, deduplicating, enriching, filtering, and performing correlation—essential for enabling deeper analysis and subsequent incident response activities.

Creating a New Event Playbook

1. Click on the Configuration navigational link.

2. Click on the Event Playbook icon.

3. Select the +Playbook button.

4. Enter a name for the playbook.

5. Click on the OK button.

The system automatically redirects you to the newly created playbook, allowing you to begin building your workflow.

Adding Playbook Tasks

1. Drag and drop a Data Formatter task onto the On Event Ingestion trigger.

   

2. Enter a name for this playbook task to enable easy identification

   

3. Drag a Create Incident Command task onto the previous Data Formatter.

   

   1. Click on the Command task within the task menu to render the command selection modal.

   2. Click on the Utility Commands tab.

   3. Type Create Incident within the search field.

   4. Drag the Create Incident task outside the command selection modal, then onto the Data Formatter task.

4. Click on the newly added Create Incident command task to render its configuration pop-up, for simplicity, we configured the first five input parameters as example.

   

Implementing Workflows in the Playbook

Within the playbook, users can design and build workflows tailored to specific requirements by using drag-and-drop tasks from the task menu.

Using the Task Menu

Exploring Task Options

1. Hover over a task in the bottom task menu to preview its name and description.

2. Click the three-dot icon to view additional tasks that are not immediately visible.

Managing the Task Menu

• To hide the task menu, click on the arrow button at the bottom.

• To unhide the task menu, click on the arrow button again.

Additional Information on Task Types

• Command Task

• Data Formatter Task

• Stage Task

• SLA Task

• Conditional Task

• Interaction Task

• Merge Task

• Unwind Task

• REST API Task

• Passdown Task

ADDITIONAL RESOURCES

For first-time users, it is recommended to begin with simpler tasks like the Command Task and gradually explore advanced tasks like REST API Task or Merge Task to understand their capabilities.

CAUTION

Avoid building workflows with unnecessary or redundant tasks, as this can impact system performance. Use only the tasks that align with your workflow requirements.