Actionplans are the Socrates-optimized version of runbooks. They are generated from runbooks and provide a transparent and structured set of Actions for Socrates as it works through them, ensuring clarity, control, and increased reliability via well-defined guardrails intended to reduce errors.
Overview
Like runbooks, Actionplans can be viewed either from a case's Runbook tab or the Runbooks page.
The runbook content is translated into a list of Actions with a title, a description, an Action type, and a method or nested action.
There are three Action types: the logical Loop and If flow-control Actions, and a regular Action. Both flow-control Actions use nested Actions rather than regular Actions.
The method determines how Socrates will execute a regular Action. It can either be Use tool or Think. With Use tool, Socrates will execute either a built-in or custom tool in Torq—this method is best suited for tasks requiring third-party APIs or other capabilities not available to the AI model. Custom tools refer to On-demand workflows that have the socrates tag. Socrates determines how and when to use each tool for each Action based on workflow descriptions, as well as the input parameters and their descriptions. The Think method refers to Socrates's ability to reason, summarize, analyze, and extract data via its native-LLM capabilities.
For cases assigned to Socrates, runbooks cannot be executed without an Actionplan. If a runbook already has an Actionplan, it will automatically be executed. If not, navigate to the Runbooks page and generate an Actionplan.
Once a case has been manually or automatically assigned to Socrates, the Actionplan's syntax and tools will be validated. If the Actionplan is invalid, it will not be run and informative errors will be displayed for failure remediation. If the Actionplan is valid, it will be executed and System Events will be logged in Torq.
Learn how to enhance observability and compliance with Socrates monitoring and auditing.
How to use
An Actionplan cannot be modified from a case's Runbook tab. To create, edit, or delete an Actionplan, navigate to the Runbooks page.
Create an Actionplan
To generate an Actionplan:
Open the Runbooks page: Navigate to Investigate > Runbooks and select the relevant runbook.
Add an Actionplan: On the Actionplan tab, click Generate Actionplan.
Review the Actionplan: Review each Action's instructions and methods and make any necessary modifications.
Save the Actionplan: Click Save Actionplan to apply the changes.
Edit an Actionplan
Manual changes to the Actionplan do not affect the runbook. Modifying the runbook and then regenerating the Actionplan will discard any previous edits to the Actionplan.
To edit an Actionplan:
Open the Runbooks page: Navigate to Investigate > Runbooks and select the relevant runbook.
Edit the Actionplan: On the Actionplan tab, edit an Action's instructions or method and click Save Actionplan to apply the changes.
Regenerate an Actionplan
Editing the runbook doesn’t automatically regenerate the Actionplan. If the runbook is edited and the new version is saved, the Actionplan must be regenerated.
If the Actionplan wasn't initially generated as desired, you can regenerate it. To regenerate an Actionplan:
Open the Runbooks page: Navigate to Investigate > Runbooks and select the relevant runbook.
Regenerate the Actionplan: On the Actionplan tab, click Regenerate Actionplan and confirm you want to regenerate.
Review the Actionplan: Review each Action's instructions and methods and make any necessary modifications.
Save the Actionplan: Click Save Actionplan to apply the changes. They will be recorded in the Audit Logs.
Delete an Actionplan
Socrates requires an Actionplan to investigate a case. Deleting an Actionplan is irreversible and prevents Socrates from handling the case.
To delete an Actionplan:
Open the Runbooks page: Navigate to Investigate > Runbooks and select the relevant runbook.
Delete the Actionplan: On the Actionplan tab, click Delete and confirm the deletion.
Troubleshooting
An Actionplan can be saved but will not run if it is invalid. This can occur due to a missing or invalid tool. To be executed, the Actionplan must be edited—selecting the correct tools will resolve any errors.
When an Actionplan contains at least one error, it will be indicated by a warning icon next to the relevant Action. A banner tallying up all the errors will also be displayed at the top of the Actionplan.
Example: Triage Identity Alert
The Actionplan above is generated from the Triage Identity Alert runbook. It uses the Think method to analyze the alert and retrieve all affected users, and then utilizes both a Loop and an If flow-control Action.
Socrates loops through each user affected by the alert and retrieves their details via a workflow that obtains employee details from Okta. This ensures Socrates iterates over all values.
Once Socrates has each user's status, it proceeds with one of two options. If the user is a VIP, Socrates uses a workflow that sends them a Slack message warning them of account compromise. If the user is not a VIP, Socrates adds a note to the case stating the user's non-VIP status. This conditional flow-control Action ensures Socrates evaluates a condition before proceeding.
FAQ
Can an Actionplan be edited within a case's runbook tab?
Like runbooks, Actionplans cannot be modified within a case's Runbook tab. You can currently only edit them on the Runbooks page.
Can a Socrates-assigned case execute a runbook without an associated Actionplan?
Socrates-assigned cases must execute Actionplans generated from runbooks. To add an Actionplan, navigate to the Runbooks page and select the relevant runbook.
If a case with a runbook but no Actionplan is assigned to Socrates, will an Actionplan automatically be generated from the runbook?
An Actionplan will not automatically be generated. To add an Actionplan, navigate to the Runbooks page and select the relevant runbook.