Lifecycle Runbooks

Lifecycle runbooks are runbooks An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. that execute automatically when a triggering lifecycle event occurs on an incident A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself.. They track the status The current state of an incident or runbook, indicating its progress through investigation and resolution workflows. of ongoing incidents and run actions when that status or other lifecycle conditions change.

Each lifecycle runbook starts with a single lifecycle trigger A set of one or more indicators that have been correlated based on certain relationships, such as time, metric type, application affected, location, or network device. (e.g. Status Changed, Runbook Completed, Note Added, Note Updated, Ongoing State Changed, Indicators Updated). When the corresponding event happens on an incident, the runbook runs and can use the incident context and data from earlier in the incident lifecycle.

Lifecycle runbooks are listed on their own Runbooks Page and are edited in the same Runbook Editor as other runbook types.