Learn about creating user-defined playbooks to improve your company's response to possible security risks.
Create user-defined playbooks from scratch to meet the specific security needs of
your
company, such as assessing and mitigating account configuration risks and automatically
responding to Workbench alerts. Depending on the type of playbook, user-defined
playbooks can be executed manually or periodically, or provide automated responses
when
enabled.
User-defined playbooks consist of various node types that allow you to trigger execution, define the target of the playbook, handle conditions,
and carry out actions. The following table describes the user-defined playbooks on
the Playbooks tab.
|
Column
|
Description
|
||||
|
Trigger
|
The way the playbook is triggered
|
||||
|
Playbook
|
The name of the playbook
|
||||
|
Type
|
The type of the playbook
Options are as follows:
|
||||
|
Last modified
|
The date and time the playbook was last modified
|
||||
|
Created by
|
The user that created the playbook
|
||||
|
Scope
|
Asset visibility of the user who created the playbook
The playbook only applies to targets within the asset visibility of the creator's
role. If the creator's user role is deleted, the playbook becomes deactivated until
another user reactivates it by editing or enabling the playbook. Upon reactivation,
the playbook applies to targets within the asset visibility scope of the user who
reactivated it.
For more information on asset visibility scope, see What is Asset Visibility Management?
|
||||
|
Execution count
|
The number of times the playbook was executed
Clicking the number takes you to the Execution Results of the playbook.
|
||||
|
Duration
|
The average of the playbook execution duration
|
||||
|
Status
|
The status of the playbook
Options are as follows:
|
||||
|
Action
|
The action that could be taken on the playbook
|
): manually executed by clicking the icon
): scheduled to execute at a set time each day, week, or month, or manually executed
by clicking the 
): automatically or manually triggered from Workbench when an alert is triggered on
): manually triggered from Workbench when an alert is triggered on You can currently create six types of user-defined playbooks:
 |
ImportantThe availability of certain user-defined playbook types depends on your license
entitlement for the associated Trend Vision One
features and the required data sources. For more information, see Security playbooks requirements.
|