Build and apply playbooks

Integrator Admin

Playbooks encode your team's repeatable investigation procedures as an ordered list of steps that analysts run against a case.

Anatomy of a playbook

A playbook is a named, ordered set of steps (up to 50). Each step has a type:

Step type	Meaning
ACTION	A task the analyst performs (e.g. "Isolate the host").
DECISION	A branch point where the analyst chooses how to proceed.

Each step has a label, an order, and optional guidance.

Create a playbook

1. Sign in with the playbooks:manage permission (admin/senior analyst).
2. Go to Playbooks → New.
3. Add steps in order, choosing ACTION or DECISION for each and writing clear, concise labels.
4. Save.

Keep steps actionable

Write each step as a concrete instruction. DECISION steps should make the choices explicit so any analyst follows the same path.

Apply a playbook to a case

1. Open a case and choose Apply playbook (requires playbooks:apply).
2. Select the playbook. This creates an execution attached to the case.
3. Work the steps; each step result moves through PENDING → ACTIVE → COMPLETED (or SKIPPED).

A case execution as a whole is IN_PROGRESS, then COMPLETED or ABANDONED.

Permissions

Action	Permission
View playbooks	playbooks:read
Create/edit playbooks	playbooks:manage
Apply to a case	playbooks:apply

Related

• Case lifecycle & concurrency
• Manage users and roles