Overview
Runbooks give analysts predefined investigation guides within a case. Associate runbooks with cases to keep investigations consistent, in line with organizational standards, and to unify case management procedures.
Runbook steps
Automate runbook actions in workflows with the following steps:
Associate a runbook to a case
Create a runbook
Delete a runbook
Dissociate a runbook from a case
Get runbook
Get runbook by name
List all runbooks
Update a runbook
When to use
Runbooks can be managed in the centralized Runbooks page, or automatically using workflows:
Runbook management function | Manage automatically in workflows | Manage in the Runbooks page |
Create a runbook | ✓ | ✓ |
Edit content | ✓ | ✓ |
Delete runbook | ✓ | ✓ |
Add source name and URL | ✓ | x |
Lock runbook content | ✓ | x |
Learn how to use a runbook during an investigation, and how to manage runbooks manually in the centralized Runbooks page.
How to use
Manage runbooks automatically
Use runbook steps in workflows to create, update, and associate runbooks with cases.
Create and associate runbooks
Create a runbook:
a. Add the Create a runbook step to the workflow.
b. In the Properties panel, enter a unique title and fill the content area with HTML, Markdown, or plain text. Source this content dynamically from external systems such as Confluence or Notion to integrate existing documentation into the case management workflow.
c. (Optional) Add a Source name and Source URL for source traceability.
d. (Optional) Toggle Lock content to prevent manual edits from the Runbooks page.
Associate the runbook with a case:
a. Add the Associate a runbook to a case step to the workflow.
b. Link the runbook to a case. The runbook is accessible in the case Runbook tab.
Use case: Sync runbooks from an external source
Set up a workflow to automatically sync a runbook from an external service, such as Confluence or Notion. If a runbook with the provided title already exists, update its content; if not, create a new runbook using the content retrieved from the workflow context.
Add the Source name and Source URL in the Create a runbook or Update a runbook steps to track the origin.
Enable Lock content to prevent manual edits on the Runbooks page.
Use case: Associate runbooks by case category
Automate runbook association in workflows to attach the relevant runbook to every case of a given type from the moment it is created.
Set up a workflow to automatically associate a relevant runbook with each new case based on its category. Each case gets the right investigation guidelines as soon as it is created.
Permissions
To access the Runbooks page, users need cm.runbook.read or cm.runbook.write permissions. Based on the permissions they have, users can:
Permission | Access level | Actions |
| View runbooks | View the content of runbooks |
| Create and update runbooks | Create, edit, and delete runbooks |