Executing On-Demand Runbooks

On-demand runbooksClosed An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. can be executed from three places within the UIClosed User Interface. The visual components and controls that users interact with to access features and manage the system.:

Executing an on-demand runbook uses the Run Runbook dialog:

  1. Open the On-Demand runbooks page to see those runbooks listed.

  2. For the on-demand runbook you want to execute, click Run to display the Run Runbook dialog. This dialog lists the parameters you need to supply in order for the runbook to execute. These correspond to the variables that were added to the runbook's Input node when the runbook was defined. (For comparison, incidentClosed A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself. runbooks do not use this dialog and its inputs because all the relevant context is supplied to incident runbooks by their triggersClosed A set of one or more indicators that have been correlated based on certain relationships, such as time, metric type, application affected, location, or network device..) The parameters include:

    • Primary entity: The type of network object for which the on-demand runbook executes.

    • Additional Parameters: Specify values to populate the variables included in the runbook's Input node.

  3. Specify the Reference Time at which the runbook will examine data for generating outputClosed A document containing data sets generated by the execution of a runbook, including output of queries and reports from point products, as well as output of analysis or other runbook nodes. (the default is Now) and click Run. The runbook's output will be listed on the Runbook Analyses page.