My Second Playbook | User Docs

Last Updated: October 26, 2026

In D3, playbooks provide a structured and automated approach to handling security incidents, ensuring workflow consistency, efficiency and reliability. An investigation playbook (previously incident playbook) automates the analysis and response of incidents, such as the incidents your preprocessing playbook escalates from events.

This tutorial builds on My First Playbook, where you built a preprocessing playbook that escalates ingested events to incidents. Here you build an investigation playbook that sends an email.

Generating with AI

Morpheus, D3's AI assistant, can draft an investigation playbook for you. Describe the response you want, or let Morpheus infer it from an incident, and it composes the trigger, tasks and approval gates for you to review.

Go to Configuration > Investigation Playbooks.
Select + Playbook, then Generate with AI ("Describe it — Morpheus composes the steps"). The Generate with AI button on the Generate a playbook with Morpheus AI banner opens the same window.
Choose how Morpheus starts:
- Infer from context: Morpheus infers the playbook from the trigger data you choose ("Set the scope and I'll infer the playbook").
- Describe it myself: type what the playbook should do when it fires. The window also lists SUGGESTIONS to start from.
Under WHAT I'LL USE, choose the Site (required) and the Trigger data (required): an incident from that site; search for it by number. Optionally, set the Thinking effort (Standard or Deep), add Global lists as reference lists, and add Connected integrations. With no integration selected, the draft uses no integration commands.
Select Generate playbook.

Generating an investigation playbook

The Generating playbook window shows each step Morpheus works through and the time elapsed. It notes that this usually takes 10–20 minutes, and Cancel stops it. When it finishes, the playbook opens in the editor as a Draft. A Generated by Morpheus note sums up what the playbook does, with its number of tasks and your prompt.

A generated playbook

A generated investigation playbook open in the editor as a Draft, with the Generated by Morpheus summary, its tasks on the canvas, and Modify with AI in the toolbar

REVIEW BEFORE USE

Morpheus never runs actions on its own, and nothing runs until you enable the playbook. Check every task and test the playbook before you select Go Live. To change the draft, select Modify with AI in the toolbar: Morpheus can review the whole playbook and propose changes that you approve one by one, or you can describe the change yourself. You can also edit the tasks by hand.

Building the Playbook

To build the playbook manually, follow these steps. The tutorial builds a playbook with one Send Email task; you add it the same way you added tasks in My First Playbook.

Go to Configuration > Investigation Playbooks (in the AUTOMATION group of the sidebar).
Select + Playbook, then Blank playbook.
In the New Playbook window, enter a Playbook Name and select OK. The new playbook opens in the editor, with its On Playbook Start trigger.
Select the + on On Playbook Start, then New Command Task. You can also drag Command from the task bar at the bottom of the canvas.
In the task's settings, enter a Task Name (here Send Email), then open the Command list, search for Send Email and select it. View Sample Data shows sample data for the command's inputs and outputs.
Under Input Parameters, enter a valid email address in 1. To Addresses, and a sample 2. Subject and 3. Email Body.
Make sure Auto Run is selected under the input parameters, then select the check mark at the top of the settings to keep the task. The task appears on the canvas, connected to the trigger.

How to input dynamic values?

In playbook workflows, values are often dynamic. Instead of typing a fixed value, switch on Dynamic beside an input parameter to take its value from data that earlier tasks or the incident produced. See Dynamically Selecting Data.

SUCCESS

This investigation playbook is now ready to run on incidents. To run it on the incidents your preprocessing playbook escalates, open the Create Incident task you added in My First Playbook and select this playbook in its Playbook input parameter.

Testing the Playbook

Select Test Playbook in the toolbar.
Select Run Test in the window that opens.
Open the email account entered in To Addresses to verify that the email was received.

For more on testing, see Playbook Testing and Task Node Re-runs; for command tasks, see Command Tasks; for the editor, see Investigation Playbooks.