Executing a Playbook

Role Availability Read-Only Investigator Analyst Manager

Each playbook contains one or more actions, which are associated with one or more alarms in USM Anywhere. When an alarm associated with a configured playbook is triggered, users will have the option to execute any associated manual playbooks. Automated playbooks associated with an alarm will run automatically when triggered, but USM Anywhere enables users to manually execute failed and completed automated playbooks.

Note: You can view a history of all of your executed playbooks in the Playbooks History tab. A list of all playbooks created in your instance can be found in the My Playbooks tab.

Executing a Manual Playbook

When an alarm associated with a configured manual playbook is triggered, users will have the option to run that playbook by executing the actions within it. Once an action is executed, that playbook is considered In Progress. Once all of a playbook's actions have been executed, the playbook is considered Complete.

To execute a manual playbook

  1. Go to Activity > Alarms, and then select an alarm to open its detail pane.
    This must be an alarm generated from an alarm rule associated with a playbook, unless you have configured playbooks that apply to all alarms.

  2. Click Run Playbook to open a list of all playbooks available for that alarm, and then select the playbook you want to execute.
    Alarm details pane highlighting the Run Playbooks drop-down

    Note: If this drop-down is not shown, then there are no playbooks available for this alarm.

    The Run Playbook dialog box opens and lists all of the actions for the selected playbook.

  1. Click Run Action to execute the current action.

    Since actions are configured sequentially, actions can only be executed in order.

    • If this playbook has not yet been executed for this alarm, only the first action will be available.

    • If this playbook is already in progress for this alarm, the next action that has not yet been run will be available.

    • The Run Playbook dialog box showing the playbook actions to be executed

    Important: If the playbook includes any manual actions, you will have to manually execute the step or steps described in that action. Once you have completed the steps this action describes, use the button to mark it Completed.

    Once you have executed an action, you will see a notification message in the upper right of your USM Anywhere indicating whether the action was successfully executed. If so, the status of that action will change to Completed and the next action's Run Action button will be enabled.

  2. (Optional.) Continue executing the remaining actions in this playbook.
    If the Run Playbook dialog box is closed before all actions are successfully executed, the playbook is considered In Progress. Once all actions in a playbook are successfully executed, the playbook is considered Completed.

Executing an Automated Playbook

Automated playbooks execute on their own. However, USM Anywhere enables you to manually initiate both failed and completed automated playbooks. You can manually initiate an automated playbook from the Alarms page or rerun an automated playbook that has already been executed from the Playbooks History tab. All the actions within an automated playbook will still run automatically when the automated playbook is manually initiated.

To manually initiate an automated playbook from the Alarms page

  1. Go to Activity > Alarms.

  2. Select the alarm associated with the automated playbook to open its detail pane.

  3. Click Run Playbook to open a list of all playbooks available for that alarm, and then select the automated playbook you want to manually initiate.
    Alarm details pane highlighting the Run Playbooks drop-down
    The Run Playbook dialog box opens.

  4. Click Run All.
    All the listed actions will run automatically.

To manually rerun an automated playbook from the Playbooks History tab

  1. Go to Settings > Playbooks > History.

  2. Select the automated playbook execution that you want to rerun.
    The Playbook Execution Details page opens.

  3. Click Run Playbook.
    Playbook Execution Details page highlighting the Run Playbook button
    The Run Playbook dialog box opens and lists all of the actions for the playbook.

  4. Click Run All.
    All the listed actions will run automatically.