VERISCO Alertio Respond

Playbooks

A playbook turns a response procedure into a repeatable sequence of actions. It is always started by a person, resolved against real data first, and can be undone.

Open Playbooks in the Respond group.

What a playbook is#

A defined sequence of response actions, carried out together against one context. For example, Contain Malicious Source IP blocks an attacker's address across the fleet; Account Compromise Containment blocks the address an account was misused from and disables the account.

Each playbook has a trigger type, the kind of thing it runs against:

Trigger	Runs against
Alert	One alert and the observables in it.
Incident	An incident and everything it involves.
Agent	One endpoint.

Started by a person, always

Playbooks never run automatically. The engine could; the policy does not. For a platform able to isolate machines, a person decides.

Running a playbook#

From an incident, select Run playbook. From the library, open a playbook with View flow.

Option	What it does
Dry run	Resolves every step against real data and shows exactly what would happen, without carrying anything out.
Run playbook	Executes it. Each step must be acknowledged before it runs.

Choose the context type and supply any variables the playbook needs; Refresh plan recalculates the resolved steps.

Completed runs are listed with each step's outcome. Undo run reverses a run, step by step, for every step that has a reversal, such as releasing a block or an isolation.

Permissions#

To	You need
Run a playbook made of standard actions	Analyst or Administrator
Run a playbook that contains a destructive action	Administrator
Create, edit, enable or disable playbooks	Administrator

Managing the library#

The library lists every playbook with its trigger and the actions it performs. Filter by state (Enabled, Disabled) and by trigger, or search by name, description or action. New playbook and Edit flow open the editor.

Something missing or wrong on this page? Tell us and we will fix it.