Explore the Playbooks page
A playbook is built on triggers, actions, and flows. When it's triggered, the playbook progresses through actions to reach a final resolution. The flow of control runs from left to right, beginning with a defined trigger (yellow box) as the first component, which is mandatory. It then moves to the second component that can be a set of defined actions the playbook must perform (blue box). The last component involves determining the flow of the playbook with an if-then-else condition (purple box).
Open the playbooks page
To open the Playbooks page, go to Response > Playbooks.
The following actions are available:
-
Plus
: Add a new playbook or block. Select the folder and environment for the playbook or block. You can select one or multiple environments and environment groups, or a combination of both. Even if a playbook is associated with a specific environment group, the associated environment group's scope can still be changed and the playbook's scope automatically updates to match the new environment group scope.
-
Edit
: Select single or multiple playbooks and blocks for use with the Actions menu. To edit the folder name, click Edit, and click and hold the pointer over the name, and then change the folder name. Hold the pointer over the name, click it, and enter the new name. Once you the edit a playbook, you can delete playbooks, as needed.
-
Filter
: Click filter_alt Filter to filter the display based on the following criteria:
- Playbook simulator is on toggle
- Show Active Playbooks toggle
- Priority: Set the attachment order of playbooks for the alert. Only one playbook attaches automatically, based on priority.
- Environments (multi-select option for environments and environment groups)

- New Folder: Add a new playbooks folder; the playbook automatically inherits any changes made to its associated environment groups. Playbooks associated with environment groups can be applied to cases originating from any environment within those groups.
- Duplicate: Create a duplicate playbook with these options:
- Keep or change priority
- Keep in same folder or move to a different folder
- Single, multiple, or all environments, where all indicates all defined environments, present or future.
Top section of Playbook Designer
The top section of the Playbook Designer pane features a horizontal toggle to enable or disable the playbook. It also displays a summary, including the playbook name, creator's name, creation timestamp, associated environment, and a brief description. You can also activate the simulator and add a customized view.
Using the Playbook Designer's features, you can do the following actions:
For more information, see the following:
Define Customized alert views from Playbook Designer
Working with the Playbook Simulator
Need more help? Get answers from Community members and Google SecOps professionals.