Built-In Runbooks

Built-in runbooks An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. are runbooks supplied by Riverbed IQ Ops with the product. You cannot delete or rename them, but you can open them, duplicate them, and edit the duplicate to create your own runbooks. Built-in runbooks function as default templates and starting points so you can customize, optimize, and tune automation for your environment without building from scratch. See runbook definition.

Finding built-in runbooks

All runbook types are listed together on the Runbooks page. To list only the runbooks provided by Riverbed IQ Ops, expand Builtin in the Filters panel, select True, and click Apply Filters. To narrow the list to one runbook type, also select a value under Runbook Type. For more on the Runbooks page and its filters, see Runbooks Page.

Built-in incident runbooks

Riverbed IQ Ops includes several built-in incident runbooks that run when a new incident A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself. is created. Each is tied to a trigger entity (e.g. Device, Interface, or Application/Location) and provides a pre-defined investigation flow you can use as-is or copy and modify. The built-in incident runbooks include:

• Device Down Issue.

• Multi-Device Down Issue.

• Interface Performance Issue.

• Application Location Performance Issue.

For a detailed overview of the built-in incident runbooks and how they fit into incident automation, see Built-In Runbooks Overview.

Built-in subflows

In addition to full runbooks, Riverbed IQ Ops provides built-in subflows A reusable automation chunk that performs frequently used functions, such as opening a ticket in an external system, and can be used to implement integrations with third-party systems. that you can drop into your runbooks as reusable steps (e.g. parsing an alert or creating a ticket). To list built-in subflows, open the Subflows page and use the Builtin filter. For details, see Subflow Overview.

Some built-in subflows, including Riverbed IQ Ops Assist skills, are proprietary and read-only. You cannot duplicate, edit, export, or delete a proprietary subflow, regardless of your assigned roles. For details, see Working with Subflows.

Using built-in runbooks as templates

To create a custom runbook based on a built-in one, open the ... (Actions) menu on the runbook's row on the Runbooks page and select Duplicate. The duplicate is a copy you own; you can edit it, change its name, and enable or map it to triggers without affecting the original built-in runbook. Duplicating a built-in runbook is the recommended way to adapt the default investigations to your needs.