Runbook Node Categories

Runbook An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. nodes Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations. are grouped into categories in the runbook editor palette. Choosing a category is the first step to adding a node to your runbook. Depending on product and runbook type, only some categories are available. For which runbook types support which categories, see Runbook Node Compatibility Matrix. For how nodes are assembled, see Adding and Assembling Runbook Nodes and Runbook Editor.

Entry points

These categories provide the starting node for a runbook or subflow.

Triggering Entity

Start the runbook with a single trigger A set of one or more indicators that have been correlated based on certain relationships, such as time, metric type, application affected, location, or network device.. Trigger nodes start incident, on-demand, or external (webhook) runbooks. Incident runbooks can start from an interface, device, application and location, application activity and location, or health event and location. For runbook types, see Incident, On-Demand, and External (Webhook).

Lifecycle Triggers

Start a lifecycle runbook when a specific lifecycle event occurs on an incident. For details, see Lifecycle Runbooks.

Subflow Input

Start a subflow with a single input. Use this category when building the subflow itself. See Subflows and Subflow Input.

Data

Data Queries

Get data about the trigger and forward it to other nodes. Data query nodes share properties such as filters, limits, and metric collection. For details, see Data Query Properties and How Filtering Works in Runbook Nodes.

Processing

These categories transform, aggregate, or branch on data.

Functions

Transform data, join execution paths, control timing, or use AI. The available nodes include Aggregator, Transform, GenAI, Agentic AI, Coalesce, Merge, and Delay. Aggregator is not available in lifecycle runbooks. Availability of the AI nodes depends on feature configuration. See Aggregator, Transform, GenAI, Agentic AI, Coalesce, Merge, and Delay.

Logic

Add conditions to branch the runbook. See Decision Branch.

Variables

Define variables for manipulating data. See Set Primitive Variable and Set Structured Variable.

Effect

These categories affect the incident, call external systems, or use AI.

Impacts

Mark network resources as affected by the incident A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself.. See Set Incident Priority and the other impact nodes.

Integrations

Call external systems, for example via HTTP. See HTTP Request.

Presentation

These categories display data or annotate the runbook.

Visualizations

Show data in a table, chart, graph, gauge, card, or text view. Visualization nodes are available in incident, external, and on-demand runbooks. Connection Graph is available only in incident and on-demand runbooks.

Miscellaneous

Annotate the runbook with comments or notes. See Comment.

Structure

These categories define reusable subflows and how they start and end.

Subflows

Call a subflow A reusable automation chunk that performs frequently used functions, such as opening a ticket in an external system, and can be used to implement integrations with third-party systems. as a reusable component. See Subflows.

Subflow Output

Terminate the subflow and return a output A document containing data sets generated by the execution of a runbook, including output of queries and reports from point products, as well as output of analysis or other runbook nodes. to the caller. See Subflow Output.