Managing Playbooks

Scenario

This section describes how to manage playbooks, including Viewing Existing Playbooks, Exporting Playbooks, Disabling a Playbook, and Deleting a Playbook.

Viewing Existing Playbooks

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
4. In the navigation pane on the left, choose Security Orchestration > Playbooks.
5. On the Playbooks tab page, view playbook information.
   • The numbers of Pending review, Not enabled, and Enabled playbooks are displayed above the playbook list.
   • View the information about existing playbooks.

     If there are many playbooks displayed, use filters to search for a specific one.

     To view details about a playbook, click its name to go to its details page.

     Table 1 Playbook parameters

     Parameter	Description
     Name	Name of the playbook to be created.
     Dataclass	Data class of the playbook
     Playbook Status	Current status of the playbook The status can be Enabled or Disabled.
     Current Version	Current version of the playbook
     Monitoring	Click to view the playbook running monitoring information. Select Time: Select the monitoring time to be viewed. You can query data in the last 24 hours, last 3 days, last 30 days, or last 90 days. Edition: Select the monitoring version to be viewed. You can query all, currently valid, and deleted types. Running Times: You can view the total number of running times, number of scheduled triggering times, and number of incident triggering times of a playbook. Average Running Duration: allows you to view the average running duration, maximum running duration, and minimum running duration. Average running duration = Total running duration of instances/Total number of instances. Instance Status Statistics: allows you to view the total number of running instances, the number of successfully running instances, the number of running instances, the number of failed instances, and the number of terminated instances.
     Created By	User who creates the playbook
     Created	Time when a playbook is created.
     Updated By	User who last modified the playbook
     Updated At	Time when the playbook was last updated.
     Description	Description of a playbook

Exporting Playbooks

SecMaster supports the export of playbooks whose Status is Enabled.

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
4. In the navigation pane on the left, choose Security Orchestration > Playbooks.
5. Select the playbooks to be exported and click in the upper right corner of the list. The dialog box for confirming the export is displayed.
6. In the dialog box that is displayed, click OK to export the playbooks to the local host.

Disabling a Playbook

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
4. In the navigation pane on the left, choose Security Orchestration > Playbooks.
5. In the Operation column of the target playbook, click Disable. A confirmation dialog box is displayed.
6. In the displayed dialog box, click OK.

Deleting a Playbook

To delete a playbook, the following conditions must be met:

• The playbook is not enabled.
• No activated playbook version exists in the current playbook.
• No running playbook instance exists.

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
4. In the navigation pane on the left, choose Security Orchestration > Playbooks.
5. In the Operation column of the playbook to be deleted, click Delete.
6. In the displayed dialog box, click OK.
   

   Deleting a playbook will delete all its versions by default. Deleted playbook versions cannot be restored. Exercise caution when performing this operation.