Managing Playbooks

Scenario

This section describes how to manage playbooks, including Viewing Existing Playbooks, Exporting Playbooks, Disabling a Playbook, and Deleting a Playbook.

Viewing Existing Playbooks

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

4. In the left navigation pane, choose Security Orchestration > Playbooks.
   Figure 2 Accessing the Playbooks tab
   

5. On the Playbooks tab page, view playbook information.
   Figure 3 Viewing playbook information
   
   • The numbers of Pending review, Not enabled, and Enabled playbooks are displayed above the playbook list.
   • View the information about existing playbooks.

     When there are a large number of playbooks, you can use the search function to quickly search for a specified playbook with search filters such as the status, name, description, or data class of the playbook. Enter a keyword in the search box, and click .

     Table 1 Playbook parameters

     Parameter	Description
     Name	Name of the playbook to be created.
     Dataclass	Data class of the playbook
     Playbook Status	Current status of the playbook The status can be Enabled or Disabled.
     Current Version	Current version of the playbook
     Monitoring	Click to view the playbook running monitoring information. Select Time: Select the monitoring time to be viewed. You can query data in the last 24 hours, last 3 days, last 30 days, or last 90 days. Edition: Select the monitoring version to be viewed. You can query all, currently valid, and deleted types. Running Times: You can view the total number of running times, number of scheduled triggering times, and number of incident triggering times of a playbook. Average Running Duration: allows you to view the average running duration, maximum running duration, and minimum running duration. Average running duration = Total running duration of instances/Total number of instances. Instance Status Statistics: allows you to view the total number of running instances, the number of successfully running instances, the number of running instances, the number of failed instances, and the number of terminated instances.
     Created By	User who creates the playbook
     Created	Time when a playbook is created.
     Updated By	User who last modified the playbook
     Updated At	Time when the playbook was last updated.
     Description	Description of a playbook

6. To view details about a playbook, click the name of the playbook.

Exporting Playbooks

SecMaster supports the export of playbooks whose Status is Enabled.

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 4 Workspace management page
   

4. In the left navigation pane, choose Security Orchestration > Playbooks.
   Figure 5 Accessing the Playbooks tab
   

5. Select the playbooks to be exported and click in the upper right corner of the list. The dialog box for confirming the export is displayed.
6. In the dialog box that is displayed, click OK to export the playbooks to the local host.

Disabling a Playbook

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 6 Workspace management page
   

4. In the left navigation pane, choose Security Orchestration > Playbooks.
   Figure 7 Accessing the Playbooks tab
   

5. In the Operation column of the target playbook, click Disable. A confirmation dialog box is displayed.
6. In the displayed dialog box, click OK.

Deleting a Playbook

To delete a playbook, the following conditions must be met:

• The playbook is not enabled.
• No activated playbook version exists in the current playbook.
• No running playbook instance exists.

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 8 Workspace management page
   

4. In the left navigation pane, choose Security Orchestration > Playbooks.
   Figure 9 Accessing the Playbooks tab
   

5. In the Operation column of the playbook to be deleted, click Delete.
6. In the dialog box that is displayed, click Confirm to delete the playbook.
   

   By default, all playbook versions in the current playbook are deleted. The deletion operation cannot be undone. Exercise caution when performing this operation.