Adding and Assembling Runbook Nodes

This topic provides detailed instructions for choosing specific nodes and assembling them on the runbook An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. canvas. For a high level overview of the workflow for creating and editing a custom runbook, refer to Creating and Editing Custom Runbooks Using the Runbook Editor. Refer to Runbook Examples for walkthroughs of some sample runbooks.

Click New on the Runbooks page to open the Runbook Editor and begin defining a new runbook. For an existing runbook, click Edit.

Begin defining a new runbook by choosing a trigger on the palette and moving it to the canvas. You can do this by dragging it to the canvas or by double-clicking it on the palette. Each runbook can have a single trigger A set of one or more indicators that have been correlated based on certain relationships, such as time, metric type, application affected, location, or network device., which specifies the set of anomalies An unexpected event or measurement that does not match the expected model. that are considered for investigation by the runbook.

When you float the cursor over a node Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations. on the runbook canvas, you see a small tool bar pop up just above the node. You can click a button on this tool bar to Edit the node's properties, Duplicate the node, Delete the node, or Add a new node after it. If you click Add, a menu pops up next to the node, providing a filtered list of nodes that are valid to attach next in the sequence. Add is not available for nodes that terminate a runbook, such as visualizations A runbook node category that shows data in a chart, graph, table, or note, providing visual representation of analysis results in runbook output. and impacts Uniform Resource Locator. The address used to access resources on the internet, such as webhook endpoints or API endpoints for runbook automation..

Choose a Data Query node to filter the Data Ocean in the context of the trigger.

Edit the Data Query node's properties: Label, Filter, Limit, and Metrics A measurement or data point that is monitored and analyzed to detect anomalies and generate incidents..