Creating and Editing Custom Runbooks Using the Runbook Editor
This topic is a high level overview of the workflow for creating and editing a custom runbook
An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook..
Click New on the Runbooks page to open the Runbook Editor and begin defining a new runbook. See runbook definition. For an existing runbook, click Edit.
The general workflow is to select a node Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations. in the palette at the left and move it onto the runbook canvas at right. See node introduction. You can do this by dragging it to the canvas or by double-clicking it on the palette. The palette lists the runbook node categories in approximate order of how they should be assembled in sequence A set of one or more indicators that have been correlated based on certain relationships, such as time, metric type, application affected, location, or network device., then a data query, then a logic A runbook node category that adds conditions to branch the runbook, enabling conditional execution paths based on data and context. operation, then an impact or a visualization A runbook node category that shows data in a chart, graph, table, or note, providing visual representation of analysis results in runbook output.)
Begin defining a new Runbook by choosing a Trigger on the palette and moving it to the canvas. See trigger definition. Each Runbook can have a single Trigger, which specifies the set of Anomalies An unexpected event or measurement that does not match the expected model. that are considered for investigation by the Runbook.
In most cases, you will want to add a data query next, to filter the Data Ocean in the context of the Trigger. Choose a data query on the palette and move it to the canvas, to the right of the Trigger you chose. If you have the Auto-Connect option active (it is active by default), an arrow will be drawn from the Trigger to the data query automatically, connecting the two nodes in a sequence. If Auto-Connect is disabled, you will need to select the Trigger and draw the connection to the data query manually.
Each time you place a new node on the canvas, you can edit its properties, though you can do this in the Runbook Editor at any time, not only at placement. Node properties vary according to the node type, and can be as simple as setting the node name or as sophisticated as specifying Metrics A measurement or data point that is monitored and analyzed to detect anomalies and generate incidents. and thresholds to control the Runbook's behavior.
Make sure to include at least one Visualization A runbook node category that shows data in a chart, graph, table, or note, providing visual representation of analysis results in runbook output. for each Runbook. The Runbook will execute and complete its investigation without one, but you will not see any of the output A document containing data sets generated by the execution of a runbook, including output of queries and reports from point products, as well as output of analysis or other runbook nodes. unless there is at least one Visualization to show it.
The Comment node (under the Miscellaneous category) enables you to annotate the Runbook as you deem appropriate. Comment nodes do not execute or affect the Runbook output, and you can use as many of them as you want to document the Runbook's behavior.
When you are finished, click the Save icon in the tool bar to save the Runbook. It will appear in the list of Runbooks shown on the Runbooks page.