My Second Playbook

LAST UPDATED: mar 21, 2025

Event playbooks (now preprocessing playbooks) are used to automate preparatory tasks—deduplicating, enriching, filtering, and performing correlation—essential for enabling deeper analysis and subsequent incident response activities.

Creating a New Event Playbook

1. Click on the Configuration navigational link.

2. Click on the Event Playbook icon.

3. Select the + Playbook button.

4. Enter a name for the playbook.

5. Click on the OK button.

The system automatically redirects you to the newly created playbook, allowing you to begin building your workflow.

Adding Playbook Tasks

1. Drag and drop a Data Formatter task onto the On Event Ingestion trigger.

   

2. Enter a name for this playbook task to enable easy identification

   

3. Drag a Create Incident Command task onto the previous Data Formatter.

   

   1. Click on the Command task within the task menu to render the command selection modal.

   2. Click on the Utility Commands tab.

   3. Type Create Incident within the search field.

   4. Drag the Create Incident task outside the command selection modal, then onto the Data Formatter task.

4. Click on the newly added Create Incident command task to render its configuration pop-up, for simplicity, we configured the first five input parameters as example.

   

Implementing Workflows in the Playbook

Within the playbook, users can design and build workflows tailored to specific requirements by using drag-and-drop tasks from the task menu.

Using the Task Menu

Exploring Task Options

1. Hover over a task in the bottom task menu to preview its name and description.

2. Click the three-dot icon to view additional tasks that are not immediately visible.

Managing the Task Menu

• To hide the task menu, click on the arrow button at the bottom.

• To unhide the task menu, click on the arrow button again.