Creating a Playbook

Role Availability Read-Only Investigator Analyst Manager

Users in the Manager role can create manual and automated playbooks. Each playbook contains one or more actions and is associated with an alarm rule An alarm rule correlates incoming events based on predefined or user-configured critera to trigger alarms in USM Anywhere when that event or sequence of events requires attention or investigation. in USM Anywhere. Automated playbooks run automatically when an alarm is triggered based off an alarm rule, while manual playbooks require users to manually execute the actions within the playbook as part of their response to the alarm in USM Anywhere.

Creating a Manual Playbook

To create a manual playbook

  1. Go to Settings > Playbooks.
  2. From the My Playbooks tab, click Create Playbook.
    Create Playbooks button highlighted on the My Playbooks tab
  3. Enter a name and description for your playbook.
  4. Ensure Is It an Automated Playbook is not selected.
    Create Playbooks page showing Is It an Automated Playbook selected
  5. (Optional.) Use the Alarm Rule Assignment to choose which alarm rules your playbook will be available for. Your manual playbook will be available to execute on the selected alarms.
    To view only the selected alarms for the playbook, click View Selected Only in the respective Correlation Rules and Orchestration Rules tabs.
    Alarm Rule Assignement section on Create Playbook page highlighting the View Selected Only button
    Click View All Rules to return to the list of all available rules.

Note: Toggle the Assign Now button to Assign Later if you would like to skip this step. Your playbook will then be available on all alarms.

  1. Under the Actions section, assign an action to your playbook.
    The Create Playbook button will be disabled until you add at least one action.
    • To assign an app-specific action:
      1. Use the Action Type drop-down to select the appropriate AlienApp from the list.
      2. Use the App Action drop-down to select an action from the list of actions available for that app.
    • To assign a manual action:
      1. Use the Action Type drop-down to select Manual Action.
      2. Use the App Action text field to type a description of the manual action that a user should take at this step.
    • To assign a system action:
      1. Use the Action Type drop-down to select System Action.
      2. Use the App Action drop-down to select a system action from the list.

Warning: Actions in a playbook must be completed in the order in which they are configured. Take care when assigning actions to your playbook to ensure that they are in the correct sequence.

You can drag and drop individual actions within the Actions section to ensure that they are in the right order before creating your playbook, or you can edit an existing playbook to change the order of its actions if that playbook hasn't been executed yet. If a playbook has been executed, you must clone the existing playbook and then edit the clone to change the order of its actions. See Managing Your Playbooks for more details.

  1. (Optional.) Click Add Action to add another action to your playbook.
  2. When you have completed all of your actions, click Create Playbook.
    Your new playbook will now be visible in the My Playbooks tab.

Creating an Automated Playbook

To create an automated playbook

  1. Go to Settings > Playbooks.
  2. From the My Playbooks tab, click Create Playbook.
    Create Playbooks button highlighted on the My Playbooks tab
  3. Enter a name and description for your playbook.
  4. Select Is It an Automated Playbook.
    Create Playbooks page showing Is It an Automated Playbook selected
  5. Use the Alarm Rule Assignment to choose which alarm rules your playbook will be available for. Your automated playbook will run automatically when one of the selected alarms is triggered.
    To view only the selected alarms for the playbook, click View Selected Only in the respective Correlation Rules and Orchestration Rules tabs.
    Alarm Rule Assignement section on Create Playbook page highlighting the View Selected Only button
    Click View All Rules to return to the list of all available rules.
  1. Under the Actions section, assign an action to your playbook.
    The Create Playbook button will be disabled until you add at least one action.
    • To assign an app-specific action:
      1. Use the Action Type drop-down to select the appropriate AlienApp from the list.
      2. Use the App Action drop-down to select an action from the list of actions available for that app.
    • To assign a system action:
      1. Use the Action Type drop-down to select System Action.
      2. Use the App Action drop-down to select a system action from the list.

Warning: Actions will be executed in the order they are assigned. Take care when assigning actions to your playbook to ensure that they are in the correct sequence.

You can drag and drop individual actions within the Actions section to ensure that they are in the right order before creating your playbook, or you can edit an existing playbook to change the order of its actions if that playbook hasn't been executed yet. If a playbook has been executed, you must clone the existing playbook and then edit the clone to change the order of its actions. See Managing Your Playbooks for more details.

  1. (Optional.) Click Add Action to add another action to your playbook.
  2. When you have completed all of your actions, click Create Playbook.
    Your new playbook will now be visible in the My Playbooks tab.