To edit a playbook, you must have one of the following roles: Main administrator, SOC administrator, Tier 1 analyst, Tier 2 analyst, Tenant administrator.
For predefined playbooks, you can only change the playbook mode and launching rule. You can also view alerts or incidents that match the predefined playbook.
You can edit a playbook only if you have permission to change the tenant to which the playbook belongs.
To edit a playbook:
In the main menu, go to Monitoring & reporting → Playbooks.
Click the name of the playbook that you want to edit.
In the window that opens, edit the playbook's properties. For more details on the playbook properties that you can edit, see Creating playbooks.
If you changed the operation mode to Auto, in the When launching several playbook instances at the same time drop-down list, select one of the following actions:
Add new playbook instances to the queue. A new playbook instance will be launched after the current one is completed. By default, this action is selected.
Terminate current execution and launch a new instance. The execution of the current playbook instance will be terminated. After that, a new playbook instance is launched.
Do not launch new playbook instances. A new playbook instance will not be launched. The execution of the current playbook instance will continue.
If you changed the operation mode to Manual, in the Action on launched playbook instances drop-down list, select an action to apply to launching playbook instances:
Terminate instances that are in progress or awaiting approval.
Terminate only the instances that are awaiting approval.
Execute all instances that are in progress or awaiting approval.
Save the changes by clicking the Save button.
You can also click the Save with comment button if you want to add a comment to the playbook before saving.