Editing playbooks

To edit a playbook, you must have one of the following roles: Main administrator, SOC administrator, Tier 1 analyst, Tier 2 analyst, Tenant administrator.

Predefined playbooks cannot be edited. You can only change the playbook mode, launching rule and view matching alerts or incidents.

To edit a playbook:

1. In the main menu, go to Monitoring & reporting → Playbooks.
2. Do one of the following:
   • Click the name of the playbook that you want to edit. In the Playbook details window that opens, click the Edit button.
   • Select the playbook from the list, and then click the Edit button.

   The Edit playbook window opens.

3. Edit the playbook's properties. For more details on the playbook properties that you can edit, see Creating playbooks.
4. If you changed the operation mode to Auto or Training, in the Instances list, choose an action to apply to launching playbook instances:
   • Terminate instances that are in progress or awaiting approval.
   • Terminate only the instances that are awaiting approval.
   • Execute all instances that are in progress or awaiting approval.
5. Click the Save button.

The playbook's properties are modified and saved.