Runbook Node Categories

Runbook An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. nodes Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations. are grouped into categories in the runbook editor palette. Choosing a category is the first step to adding a node to your runbook. Depending on product and runbook type, only some categories are available. For which runbook types support which categories, see Runbook Node Compatibility Matrix. For how nodes are assembled, see Adding and Assembling Runbook Nodes and Runbook Editor.

Entry points

These categories provide the starting node for a runbook or subflow.

Trigger Entities

Start the runbook with a single trigger A set of one or more indicators that have been correlated based on certain relationships, such as time, metric type, application affected, location, or network device.. Trigger nodes start incident, on-demand, or external (webhook) runbooks. For runbook types, see Incident, On-Demand, and External (Webhook).

Lifecycle Triggers

Start a lifecycle runbook when a specific lifecycle event occurs on an incident. For details, see Lifecycle Runbooks.

Subflow Input

Start a subflow with a single input. Use this category when building the subflow itself. See Subflows and Subflow Input.

Data

Data Queries

Get data about the trigger and forward it to other nodes. Data query nodes share properties such as filters, limits, and metric collection. For details, see Data Query Properties and How Filtering Works in Runbook Nodes.

Processing

These categories transform, aggregate, or branch on data.

Functions

Aggregate or transform data forwarded from a preceding node. See Aggregator and Transform.

Logic

Add conditions to branch the runbook. See Decision Branch.

Variables

Define variables for manipulating data. See Set Dataset and Parse Dataset.

Effect

These categories affect the incident, call external systems, or use AI.

Impacts

Mark network resources as affected by the incident A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself.. See Set Incident Priority and the other impact nodes.

Integrations

Call external systems, for example via HTTP. See HTTP Request.

AI

Send a query to AI Artificial Intelligence. Technology that applies intelligence and automation to observe environments, detect anomalous behavior, and execute automated investigations. from the runbook. See AI.

Presentation

These categories display data or annotate the runbook.

Visualizations

Show data in a chart, graph, table, or similar view. See visualization nodes in the node library.

Miscellaneous

Annotate the runbook with comments or notes. See Comment.

Structure

These categories define reusable subflows and how they start and end.

Subflows

Call a subflow A reusable automation chunk that performs frequently used functions, such as opening a ticket in an external system, and can be used to implement integrations with third-party systems. as a reusable component. See Subflows.

Subflow Output

Terminate the subflow and return a output A document containing data sets generated by the execution of a runbook, including output of queries and reports from point products, as well as output of analysis or other runbook nodes. to the caller. See Subflow Output.