Managing Playbooks

Scenarios

A playbook is a formal representation of the security operations workflow in a security orchestration system. A playbook converts the security operations workflows and procedures into a machine-readable workflow. A playbook is a predefined, structured response plan used to handle specific types of incidents or threats. A playbook explicitly lists the steps and actions to be taken under certain trigger conditions, such as the detection of a specific security incident.

This section describes how to manage playbooks, including Viewing Existing Playbooks, Disabling a Playbook, and Deleting a Playbook.

• Viewing Existing Playbooks: View information about existing playbooks, such as the number, status, and version of playbooks.
• Deleting a Playbook: Delete a playbook when it is no longer used. You can only delete a disabled playbook that has no active playbook versions or running playbook instances. Deleting a playbook will permanently remove all its historical versions by default. This action cannot be undone.
• Disabling a Playbook: Disable a playbook when you do not want to enable it but want to retain the playbook configuration. If a playbook is disabled, its Playbook Status changes to Disabled on the Playbooks page.

Viewing Existing Playbooks

1. Log in to the SecMaster console.
2. Click in the upper left corner of the management console and select a region or project.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

4. In the navigation pane on the left, choose Security Orchestration > Playbooks.
   Figure 2 Accessing the Playbooks tab
   

5. On the Playbooks tab, view playbook information.
   • The numbers of playbooks in the Pending review, Disabled, and Enabled statuses are displayed above the playbook list.
   • View the information about existing playbooks.

     If there are many playbooks displayed, use filters to search for a specific one.

     To view details about a playbook, click its name to go to its details page.

     Table 1 Playbook parameters

     Parameter	Description
     Name	Name of the playbook to be created.
     Data Class	Data class of the playbook. A data class is required for a playbook and workflow running for security orchestration and response. The playbook is triggered by data objects. A data object is the specific instance of a data class. Common data classes include alerts, incidents, indicators, and vulnerabilities. For more information about data classes, see Overview.
     Playbook Status	Current status of the playbook. The status can be Enabled or Disabled.
     Current Version	Current version of the playbook.
     Monitoring	Click to view playbook runtime monitoring information. Time Range: Select a time range for monitoring. You can query data in the last 24 hours, last 3 days, last 30 days, or last 90 days. Version: Select the version you want to monitor. You can query all, currently valid, and deleted types. Run Times: You can view how many times the playbook has been executed, as well as the playbook run times by timer trigger and event trigger. Average Runtime: You can view the average runtime, maximum runtime, and minimum runtime. Average runtime = Total runtime of instances/Total number of instances. Instances by Status: You can view the total number of instances, the number of succeeded instances, the number of running instances, the number of failed instances, and the number of stopped instances.
     Created By	User who creates the playbook.
     Created	Time when the playbook was created.
     Updated By	User who modified the playbook last time.
     Updated At	Time when the playbook was last updated.
     Description	Description of the playbook.

Disabling a Playbook

1. Log in to the SecMaster console.
2. Click in the upper left corner of the management console and select a region or project.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 3 Workspace management page
   

4. In the navigation pane on the left, choose Security Orchestration > Playbooks.
   Figure 4 Accessing the Playbooks tab
   

5. In the Operation column of the target playbook, click Disable. A confirmation dialog box is displayed.
6. In the displayed dialog box, click OK.
7. After the operation is complete, check the playbook status on the Playbooks tab. If its status changes to Disabled, the playbook has been disabled.

Deleting a Playbook

To delete a playbook, the following conditions must be met:

• The playbook is in the Disabled status.
• No activated playbook version exists in the current playbook.
• No running playbook instance exists.

1. Log in to the SecMaster console.
2. Click in the upper left corner of the management console and select a region or project.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 5 Workspace management page
   

4. In the navigation pane on the left, choose Security Orchestration > Playbooks.
   Figure 6 Accessing the Playbooks tab
   

5. In the Operation column of the playbook to be deleted, click Delete.
6. Scenario 1: MFA Has Been Configured in IAM

   In the Delete Playbook dialog box displayed, confirm the information, enter the credential authentication information, and click OK.

   The verification method can be a mobile number, an email address, or a virtual MFA. For more information about MFA, see MFA Overview.

   Scenario 2: MFA Is Not Enabled on IAM

   In the Delete Playbook dialog box displayed, confirm the information, click Auto Enter to auto-fill DELETE in the text box below, and click OK.

7. Deleted playbooks will no longer be displayed in the playbook list on the Security Orchestration > Playbooks page. Deleted playbooks cannot be restored. Exercise caution when performing this operation.

Related Operations

• Enabling a Playbook: describes how to configure and enable a playbook.
• Managing Playbook Versions: Each playbook can have only one activated playbook version. This section describes how to preview, edit, activate, deactivate, and delete a playbook version.
• Playbook Overview: describes the playbooks built into the system.