Runbooks Page

The Runbooks page lists every runbook An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. in your configuration, of every type, in a single list. Use the Runbook Type filter to show only one type. See runbook definition.

The Runbooks page includes these runbook types:

• Incident Runbooks: Automated investigations that execute in response to triggers A set of one or more indicators that have been correlated based on certain relationships, such as time, metric type, application affected, location, or network device.. See trigger definition.

• Lifecycle Runbooks: Runbooks that track the status The current state of an incident or runbook, indicating its progress through investigation and resolution workflows. of ongoing incidents A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself. and execute actions when the incident status changes.

• On-Demand Runbooks: Investigations that you execute manually rather than automatically.

• External (Webhook) Runbooks: Runbooks that execute when another application sends a webhook. See Webhooks.

Subflows have their own page. See Subflow Overview.

Navigate to the Runbooks Explorer page:

1. Click Automation in the left menu.

2. Click Runbooks.

The Runbooks page lists built-in and custom runbooks. From the page, you can edit existing runbooks, create new ones, import and export them as JSON files, and delete runbooks you no longer need. Riverbed IQ Ops does not limit the number of runbooks you can create. Runbook execution is subject to licensing, so your entitlement can limit the number of runs in a given period.

Filtering the list of runbooks

Use the Filters panel at the left of the page to narrow the list. Select one or more values in a filter category, then click Apply Filters. Applied filters appear as tags above the list. For how filters combine, see Faceted Search.

Filter categories can include:

• Runbook Type: Show only incident, lifecycle, on-demand, or external (webhook) runbooks.

• Trigger Type: Show only runbooks that start from a specific trigger type.

• Builtin: Set to True to show only runbooks provided by Riverbed IQ Ops. Set to False to show only custom runbooks.

• Allow Automation: Show only runbooks that are enabled, or not enabled, to be mapped to trigger types.

• Created By and Last Updated by: Show only runbooks created or last saved by specific users.

• Locked: Show only locked or unlocked runbooks.

• Scheduled: Show only runbooks that have, or do not have, a schedule.

• MCP Tool: Show only on-demand runbooks that are, or are not, exposed as MCP tools.

Working On an Existing Runbook

For any runbook, click on its row or click the > at its left to show its definition as a sequence of nodes. Doing this also makes several controls available:

• Edit: Open the runbook in the Runbook editor to change it.

• Export: Write the runbook definition to JSON file.

• Duplicate: Make a copy of the runbook.

• Delete: Use with caution. This will prompt you for confirmation, then will permanently remove the runbook from the system. There is no undo, once the runbook is deleted.

Creating a New Runbook

Two controls reside at the top of the page:

• New: Open the Runbook Editor to create a new runbook.

• Import: Create a new runbook by importing a JSON file of a previously exported runbook definition.

Runbook List Columns

These fields are shown for each runbook on the Runbooks page. Click a column heading to sort by that column. To filter by a value, use the Filters panel.

• Runbook: The runbook's name. This may be user-defined, or auto-generated if no user has renamed it.

• Description: A brief, user-defined explanation of what the runbook is used for.

• Trigger: The type of trigger that launches the runbook.

• Entity Type: For on-demand Runbooks only, the type of network object for which the Runbook will execute.

• Built-In: A checkmark is shown if the Runbook is provided by Riverbed IQ Ops.

• Locked: A toggle that indicates whether the Runbook is locked. When it is locked, the Runbook is available for viewing, export, and duplication, but not for editing or deletion. Use the toggle to lock or unlock the Runbook. The toggle is unavailable for built-in Runbooks and for users without the permission to change the lock setting. For details, see Locking a Runbook or Subflow.

• Last Updated: The timestamp from when the Runbook was most recently saved.

• Last Updated By: The username of the account that saved the most recent change to the Runbook.

• Allow Automation: For all Trigger types mapped to the Runbook, toggle the Runbook On to enable it or toggle it Off to disable it. This control is inaccessible if the Runbook has any errors.
  A Runbook must be On to be mappable to a Trigger type in the Automation page; if it is Off, it will not be listed in the Edit Mapping dialog as available to be mapped. If a Runbook is Off, it will not execute when a mapped Trigger fires, but an Incident A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself. still will be created; this can be useful if you want to modify the Runbook and do not want it to execute in an experimental or unvalidated state. Custom Runbooks are Off by default.

• Run button: For on-demand Runbooks only, execute the Runbook now. The Runbook's output A document containing data sets generated by the execution of a runbook, including output of queries and reports from point products, as well as output of analysis or other runbook nodes. will be listed on the Runbook Analyses page.

• ... pop-up menu: Additional controls for managing Runbooks. Most are also available from other places when working with Runbooks. The available items depend on whether the Runbook is locked. While a Runbook is locked, the Edit and Delete items are unavailable. For details, see Locking a Runbook or Subflow.

  • Export: Output the Runbook definition to a JSON file that can be imported subsequently to create a new Runbook.

  • Edit: Open the Runbook in the Runbook Editor to change it.

  • Duplicate: Copy the Runbook.

  • Delete: Use with caution. This will prompt you for confirmation, then will permanently remove the Runbook from the system. There is no undo, once the Runbook is deleted.

  • Test Run: Execute the Runbook's Logic A runbook node category that adds conditions to branch the runbook, enabling conditional execution paths based on data and context. immediately, without having to wait for a corresponding Trigger.

  • Preview Output: Show what data the Runbook will generate after it executes in response to a Trigger.