Associate runbooks with cases to provide analysts with predefined guides, ensuring consistent and thorough investigations according to your organization's standards and best practices.
Learn how to use a case's runbook during an investigation.
How to use
Runbooks can be managed in the centralized Runbooks page, or automatically using workflows:
Management function | Manage automatically in workflows | Manage in the Runbooks page |
Create a runbook | ✓ | ✓ |
Edit content | ✓ | ✓ |
Delete runbook | ✓ | ✓ |
Add source name and URL | ✓ | x |
Lock runbook content | ✓ | x |
Manage runbooks on the Runbooks page
Manage runbooks efficiently using the centralized Investigate > Runbooks page. The Runbooks page gives you complete visibility into all the runbooks available in your workspace.
In the Runbooks page, you can search, add a new runbook, and open the runbook editor to edit or delete a runbook.
Search for runbooks: Use the search bar to search by runbook name or ID.
Add new runbooks: Click Add Runbook to open the editor and create a new runbook in your workspace.
Enter a title for your runbook.
Enter your runbook instructions directly in the editor, or paste from elsewhere.
Edit runbooks: Open the runbook you want to edit and make changes directly in the editor. Click Save to confirm your changes.
Locked runbooks cannot be edited manually on the Runbooks page—they must be unlocked with the Update a runbook step in a workflow. Once unlocked, they can be edited from the Runbooks page.
Delete runbooks: Open the runbook you want to delete and click the trashcan icon in the top right.
Runbook editor
Locked runbooks must be unlocked with the Update a runbook step in a workflow before they can be manually edited.
On the Runbooks page, select a runbook to open the editor. You can edit the runbook title by clicking it, and edit runbook instructions in rich text. In the top menu bar, you can see all users currently viewing the runbook.
Runbooks created by workflows can be in Markdown, HTML, or plain text, and will appear in the editor in rich text. Runbooks that are created or edited and saved in the editor are saved as HTML.
Editing or deleting a runbook affects every case that it is associated with. Deleting a runbook cannot be undone.
Manage runbooks automatically
Runbooks can be managed automatically in workflows using runbook steps, including creating, updating, and associating runbooks with cases.
Create and associate runbooks
Create a runbook:
Search for the Create a runbook step and drag it to your workflow to generate a new runbook.
In the Properties panel, give it a unique title and fill the content area with HTML, Markdown, or plain text.
This content can also be dynamically sourced from external systems like Confluence or Notion, enabling you to integrate comprehensive documentation directly into your case management system.
Add the optional Source name, Source URL, and Lock content parameters to provide source traceability and prevent unauthorized edits to runbooks.
Associate the runbook with a case:
Search for the Associate a runbook to a case step and drag it to your workflow. Link your newly created or existing runbook to a case. This makes the runbook readily accessible within the case's Runbook tab.
Practical examples
Practical examples
Automate runbook retrieval
Set up a workflow to automatically sync a document from external services, such as Confluence or Notion, to use as a runbook. If a runbook with the provided title already exists, update its content; if not, create a new runbook using the content retrieved from the workflow context.
The source name (e.g. Confluence) and source URL of automatically synced runbooks can optionally be added via the Create a runbook and Update a runbook steps to track their origin.
When enabled, the Lock content parameter locks runbooks to prevent manual edits from the Runbooks page.
Case-specific runbook association
Create a workflow to automatically associate a relevant runbook with each new case based on the case category. This ensures that every case is supported by appropriate guidelines right from its inception.
Permissions
To access the Runbooks page, users need cm.runbook.read or cm.runbook.write permissions. Based on the permissions they have, users can:
Description | Description | Actions |
| List and view runbooks | View the content of runbooks |
| Create and update runbooks | Create, edit, and delete runbooks |