Playbook configuration

Playbook types

Security Center provides two types of playbooks:

• Predefined Playbook: Security Center includes built-in playbooks that are based on common security threat scenarios and solutions. You can use these playbooks directly without any configuration. You can also copy a predefined playbook to create a custom one, which you can then modify to suit your needs. This simplifies creating custom playbooks.

• Custom Playbook: For complex and highly personalized security threat scenarios, Security Center provides flexible custom playbooks. You can use the flow editor to freely configure various components and easily implement automated security response solutions.

Playbook parameters

• Input parameters define the conditions that trigger a playbook. Selecting different conditions updates the corresponding debugging parameter examples.

• Output parameters: These are the fields generated when a playbook runs. Subsequent nodes can use these fields. You can also use the setOutput action to allow other playbooks to reference them. The syntax is ${event.parameter_path}.

  Note

  In addition to custom output parameters, the system provides default system parameters. For more information, see System parameters in playbooks.

Step 1: Enter basic information

1. Log on to the Security Center console.

2. In the left-side navigation pane, choose Agentic SOC > Manage > Response Rules. In the upper-left corner of the console, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

3. On the Custom Playbook tab, click Create Playbook.

4. In the Create Playbook panel, enter a Playbook Name and Playbook Description, and click OK.

Step 2: Configure the playbook

1. After you create the playbook, you are automatically taken to its configuration page. You can also go to the custom playbook list and click Edit in the Actions column to go to the configuration page.

2. Configure playbook input and output parameters

   1. On the Playbook Editing page, click Settings in the upper-right corner. In the configuration panel, click Input & Output Settings.

      Note

      Each flow must have one start node and can have one or more end nodes.

      

   2. In the Input & Output Settings panel, configure the input and output parameters for the playbook. For more information, see Playbook parameters (input and output parameters).

3. Orchestrate the response flow

   To orchestrate the flow, drag components to the canvas and connect them. This topic uses the DataFormat component as an example. For information about how to configure the parameters of other components, see Flow component description.

   Important

   • The start node is named 'event'. Therefore, do not name any other component 'event'.

   • You can add and connect multiple components as needed.

   1. Select a component action

      From the Basic components section on the left, select the DataFormat component. Select an action, such as joindata or convertToJSON, and drag the action to the canvas.

   2. Configure component parameters

      To configure the parameters of a component, click the component on the canvas. Alternatively, on the Basic Information configuration page, in the Action Configuration section, click to go to the parameter configuration page. For more information about parameter configurations, see DataFormat component.

      • You can enter constants, variable parameters, system parameters, and expressions. For more information, see Component parameters and node execution flow.

      • You can also manually configure parameters. In the input box for a node, you can select a parameter from the drop-down list to generate the corresponding syntax. The following figure shows an example.

        

4. After you configure the component, click Save in the upper-left menu bar.

   Warning

   If you exit without saving, the flow information that you edited will be lost.

Step 3: Debug the flow

After you build the playbook, debug it to ensure that it runs as expected.

1. Set a breakpoint (Optional):

   • Description: A breakpoint pauses the execution at a specific component during debugging. This allows you to check intermediate results.

     Important

     • If the flow has multiple branches, the system debugs only the branch where the breakpoint is set.

     • If you set multiple breakpoints on the same branch, only the last breakpoint takes effect.

   • Procedure: Click the icon on a node to set a breakpoint.

     

2. Start debugging

   1. Click the Debug icon in the upper-left corner. In the Debug Parameters panel, click Debug.

      Note

      The debug parameters vary based on the types of input parameters that you configure for the playbook.

   2. Load sample parameters:

      1. Click Example.

      2. On the View Sample Input page, click Load Sample.

   3. Modify parameters: Modify the parameters as needed, and then click OK.

      Note

      For easier editing, the system provides an intuitive Visual Mode.

3. View the debug result

   Click the icon on a node or click Run Logs in the debugging area to view the execution details of the node, including its input, output, and status. The following table describes some of the output parameters.

   Parameter	Description
   datalist	A preview of the result data. Important A maximum of three entries are displayed for preview. To view all data, go to the Complete Output Result tab.
   total_data_successful	The number of data items that are successfully processed.
   total_data	The total number of data items that are processed.
   total_exe_successful	The number of times that the current action is successfully run.
   total_exe	The total number of times that the current action is run.
   total_data_with_dup	The number of unique data items that are successfully processed.

   

Step 4: Save and publish

After the playbook passes debugging, click Publish in the upper-left menu bar to publish the playbook.

Playbook rollback

To restore a published playbook to a previous version, you can roll it back. Follow these steps:

1. On the Custom Playbook tab, find the playbook that you want to roll back. In the Actions column, click Details. On the Basic Information tab, view the playbook's version history in the Publish History section.

2. (Optional) Test the version: Select the version to which you want to roll back, and then click View in the Actions column to open the playbook tab. In the Input Parameters (Run) area, test the selected version.

3. Select the version to which you want to roll back, and then click Roll Back to Edit or Roll Back and Publish in the Actions column.

   • Roll Back and Publish: Replaces the current draft in the editor with the selected version and publishes it.

   • Roll Back to Edit: Replaces the current draft in the editor with the selected version.

Playbook import

1. From the flow editor menu bar, click More and then select Import JSON.

2. Upload the JSON file and click OK.

Playbook execution records

In the playbook list, click a playbook's ID or Details in the Actions column to open its details page. The basic execution records are available on the Historical Execution Records tab.

Renaming a playbook

In the playbook list, click a playbook's ID or Details in the Actions column to open its details page. On the Basic Information tab, click Edit next to the playbook name.

Playbook orchestration errors

Component execution errors