Editing playbooks

To edit a playbook, you must have one of the following roles: Main administrator, SOC administrator, Tier 1 analyst, Tier 2 analyst, Tenant administrator.

For predefined playbooks, you can only change the playbook mode and launching rule. You can also view alerts or incidents that match the predefined playbook.

To edit a playbook:

1. In the main menu, go to Monitoring & reporting → Playbooks.
2. Do one of the following:
   • Click the name of the playbook that you want to edit. In the Playbook details window that opens, click the Edit button.
   • Select the playbook from the list, and then click the Edit button.

   The Edit playbook window opens.

3. Edit the playbook's properties. For more details on the playbook properties that you can edit, see Creating playbooks.
4. If you changed the operation mode to Auto or Training, in the Running instances list, choose an action to apply to launching playbook instances:
   • Terminate instances that are in progress or awaiting approval.
   • Terminate only the instances that are awaiting approval.
   • Execute all instances that are in progress or awaiting approval.
5. Click the Save button.

The playbook's properties are modified and saved.