Runbooks
Runbooks
An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. in Riverbed IQ Ops automate how you investigate and respond to network and application issues. When an incident A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself. is created, when you need data on demand, or when an external system calls in, a runbook runs a defined sequence of steps that help you understand and act on what is happening. Runbooks give you consistent, repeatable investigations instead of ad-hoc manual checks.
The steps are either pre-configured in built-in runbooks or defined by you. Depending on your needs, the steps may include:
-
Querying data.
-
Applying logic.
-
Updating an incident.
-
Calling external tools.
-
Producing visualizations and impacts.
Runbook structure
A runbook is an automated workflow that runs in response to a trigger A set of one or more indicators that have been correlated based on certain relationships, such as time, metric type, application affected, location, or network device.. It is built in the Runbook Editor by assembling runbook nodes Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations. in sequence on a canvas. Each node does a specific job (e.g. run a data query, branch on a condition, call an API, or add a visualization). The runbook runs the nodes in order, using the trigger context and data from earlier steps, and produces output that is attached to the incident, returned to the caller, or shown in the runbook result. For how to choose which nodes to use, see Assembling runbook nodes and Runbook Nodes.
Types of runbooks
Runbooks are grouped by when and how they run:
-
Incident runbooks: Run automatically when a new incident is created (e.g. from anomalous behavior on a device, interface, or application).
-
Lifecycle runbooks: Run automatically when a lifecycle event occurs on an incident (e.g. status changed, runbook completed).
-
External (webhook) runbooks: Run when an external system calls the product webhook API.
-
On-demand runbooks: Run when you (or a schedule) start them manually.
-
Subflows: Reusable sequences of nodes that you call from other runbooks rather than trigger on their own.
Working with runbooks
You manage runbooks from the Runbooks pages (Incident Runbooks, Lifecycle Runbooks, On-Demand Runbooks, and so on). From there you can create, edit, duplicate, import, export, and delete runbooks. Riverbed IQ Ops includes built-in runbooks as starting points; you can duplicate them and customize the copies for your environment.
Data available to runbooks
Runbooks can query all data sources A product in your network that forwards data to the system. This data can be streaming data used to detect anomalies and generate incidents, or data that can be fetched on demand when runbooks are executed. connected to Riverbed IQ Ops during an automated investigation. That includes NPM (Network Performance Monitoring) products and any integrated third-party tools. Data Query A runbook node category that gets data about the trigger and forwards it to other nodes in the runbook for further processing. nodes Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations. retrieve specific metrics A measurement or data point that is monitored and analyzed to detect anomalies and generate incidents., properties, and attributes from those sources to support the investigation. Runbooks can also call external APIs via HTTP Request nodes or integration subflows to pull in additional context. For how to configure what a runbook queries, see Data query properties - Filters, Limits, and the individual runbook node topics.