Runbooks & Playbooks

A runbook captures your team's standard way of handling a type of incident, written once and reused every time. During automatic triage, the AI can select a relevant runbook and let it guide how the incident is investigated, so your best practice is applied consistently, not just when your most experienced analyst is on shift.

Template types

CloudPeek supports a few related kinds of template:

• Runbook: a step-by-step procedure for investigating or responding to a type of incident.
• Playbook: a procedure linked to a specific tool, so the agent knows how to use that tool for the task.
• Persona: a defined role/voice the AI can adopt.
• Analytic rule: a detection rule written in Sigma (YAML), used to identify patterns.

Where runbooks live

In current versions, runbooks are managed as Wiki entities. Opening Runbooks redirects into the Wiki filtered to runbook pages (/wiki?entity_type=runbook). This means a runbook is a Wiki page, versioned, searchable, taggable and able to link to the entities and knowledge it relates to. See The Wiki for how to create and edit pages.

What goes in a runbook

A good runbook typically captures:

• When it applies: the alert types or conditions this runbook is for.
• Steps: the sequence of checks and queries to perform.
• What to look for: the signals that distinguish a true positive from noise.
• Response guidance: what to do once you've confirmed what's happening.

Tags help triage find the right runbook: triage pre-filters the library by tags before the AI ranks candidates and (optionally) selects one.

How runbooks are used during triage

When an incident is triaged, the pipeline:

1. Pre-filters your runbook/template library by tags relevant to the incident.
2. Asks the AI to rank the candidates and, if one is clearly relevant, select it.
3. Loads that runbook's content and uses it to shape the investigation plan (the follow-up actions) it generates.

So a well-written runbook directly improves the quality and consistency of automatic investigations.

Linking a playbook to a tool

Playbooks can be linked to a specific tool from the tool configuration screen (see Tools & Integrations). This tells the agent how to use that tool when carrying out the procedure.

Analytic rules (Sigma)

Analytic rules are detection rules written in Sigma, a standard YAML format. A valid rule includes title, logsource and detection fields. These feed CloudPeek's detection and threat-hunting capabilities.

A note on legacy runbooks

Some deployments may still run the older, standalone runbook editor (controlled by a feature flag). If yours does, you'll find a create form at /runbooks/new that collects a type, name, description, visibility, Markdown content (or Sigma YAML for analytic rules), tags and an optional execution schema. On current Wiki-backed deployments, use the Wiki instead.

Related

• The Wiki: where runbooks are authored and stored.
• Automatic Triage: how runbooks guide investigations.
• Runbooks API: the programmatic interface (and its migration to the Wiki API).